This master thesis called "The media portrait of the Anders Behring Breivik ́s attack in czech press" focuses on events that took place on the 22nd of July 2011, when a norwegian citizen Anders Breivik detonated a bomb in the centre of Oslo and killed 8 people. Then he shot 69 young people on the Utøya island. This thesis shows how these events were presented in the four most read newspapers in the Czech republic which are Aha!, Blesk, Mladá fronta DNES and Právo. The analysis focuses on the period of time between 22nd of July and 22nd of September 2011 and then also on the period from April to August 2012 when the trial took place. This master thesis combines quantitative and qualitative research design and shows that Mladá fronta DNES published the most articles out of all 287. Blesk used the biggest amount of photographs - 2.9 photographs per article. The most used photographs were of the victims and also the photographs of Breivik himself. The most frequent topics covered were of the trial, information about Breivik and memorial events. The qualitative part of the research focuses on used language means and proves that the visual part and the photographs play a very important role on the whole feel and emotions in the article.

Democracy and democratic values have stagnated and are under attack. Current criticism of democracy points towards problems with efficiency, leniency towards undemocratic elements, collective problem-solving, and a suspension of the rule of law for public good. One solution to these problems could be to focus on teaching democratic values through literature in school. A suitable novel for this endeavor is the science-fiction novel Starship Troopers, written by Robert A. Heinlein in 1959, since it functions as fictional criticism and an alternative to democracy. However, most of the previous research conducted on Starship Troopers have focused on aspects regarding militarism and fascism. This research paper differs because it focuses specifically on how democracy is critiqued in the novel and how this critique could be used to teach democratic values. Teaching democratic values should be conducted since democracy and democratic values are arguably the most essential aspects of the fundamental values of the Swedish school system. Still, the relevant school policy documents do not define how these fundamental values are connected to the system of democracy and how they could be taught in a classroom. In order to fill that gap, this paper aims to use the theories and methods of didactic potential, Socratic pedagogy, and the politics of advocacy, attack, and assent to help students become more self-aware of their fundamental democratic values. The analysis demonstrates that Starship Troopers criticizes essential elements of democracy and complements those elements with its own alternative fundamental elements and values. The analysis also demonstrates how this critique can be used as a complement in a philosophical discussion that helps students become more self-aware of their fundamental democratic values.

Durante o processo de ensino-aprendizagem-treinamento (EAT), o treinador tem o papel de planejar e conduzir as atividades, principalmente no início dessa prática. No Brasil, para que se exerça essa função deve-se obrigatoriamente concluir a formação acadêmica. Especificamente no handebol enfatiza-se as vivências como atleta e profissional na atuação dos treinadores. Ainda notam-se poucos incentivos na formação desses por parte dos órgãos que regulamentam a modalidade esportiva no país, fazendo com que busque-se conhecimentos de forma particular e isolada, os quais podem não condizer com a realidade de seus ambientes profissionais. Com isso este estudo buscou compreender a atuação dos treinadores das categorias de base de handebol no Brasil, o que eles esperam de seus jogadores diante diferentes contextos e de como ensinam. Para isso realizou-se uma revisão sistemática acerca da temática, seguida da entrevista com treinadores das diferentes categorias de base do handebol no estado de São Paulo. Na tabulação e interpretação dos dados foi utilizado o método do Discurso do Sujeito Coletivo (DSC). Na revisão sistemática identificou-se a necessidade de pesquisas que visem compreender a atuação dos treinadores do handebol brasileiro, principalmente nas categorias de base, uma vez que os trabalhos encontrados são predominantemente originários dos países europeus e/ou com treinadores experiente e que realizam seu trabalho com equipes adultas. Quanto à atuação dos treinadores de handebol nas categorias de base observou-se que os conteúdos exigidos pelos treinadores quando trabalhando suas equipes na fase defensiva e na fase ofensiva leva em consideração o processo maturacional e o tempo de vivência no handebol, porém ao analisarmos como são ensinados os conteúdos esperados, os discursos expressaram que o trabalho realizado pauta-se no ensino exclusivo de conteúdos específicos do handebol, o que não corresponde às demandas apresentadas em cada faixa etária, principalmente nas mais jovens. Conclui-se que no trabalho com as categorias de base do estado de São Paulo preocupa-se com a especificação da prática ao invés de diversificação, o que contrapõe os apontamentos feitos pela literatura de que esse tipo de treinamento pode levar os jogadores a praticarem o handebol de forma específica, existindo a possibilidade de conduzir os praticantes à especialização esportiva precoce. / In the Teaching-Learning-Training (TLT) process, coaches must plan and conduct the activities, mainly in the beginning of this practice. In Brazil, it is mandatory to complete the academic formation in order to perform this function. Specifically in handball it is reported that the athlete and professional experiences takes an important role in their professional activities. It is also noted that the Federations and Confederations do not help the coaches in their professional formation, making them seek for knowledge in a particular and isolated way, which may not match with their professional needs. This study look for understanding the youth teams coaches\' performance, what they expect of their players against some scenarios and how they teach those. For this, a systematic review about the theme has been made, followed by an interview with the Sao Paulo state youth team coaches. For the data tabulation and interpretation, it was used the Collective Subject Discourse (CSD). In the systematic review has been identified that there is a need for more research with to aim of understanding the coaches performance, mainly with the youth teams coaches, once that the publications about the theme are mostly from european countries and/or with experienced adult teams coaches. Concerning the youth teams coaches performance it was observed that they takes into account the maturational process and the handball experience time as they work their teams in the offensive and defensive phases, but if we analyze the way that they teach it, the discourses express that the activities are based on teaching many specific tasks, which do not correspond to the age needs, mainly in the youngers. It is concluded that Sao Paulo state youth teams work is concerned with the practice specification instead of the diversification, contrasting the literature appointments which says that this type of training may lead the players to a specific way of practice and conduct them to an early sports specialization.

<div>Despite the broad diversity of attacks and the many different ways an adversary can exploit a system, each attack can be divided into different phases. These phases include the discovery of a vulnerability in the system, its exploitation and the achieving persistence on the compromised system for (potential) further compromise and future access. Determining the exploitability of a system –and hence the success of an attack– remains a challenging, manual task. Not only because the problem cannot be formally defined but also because advanced protections and mitigations further complicate the analysis and hence, raise the bar for any successful attack. Nevertheless, it is still possible for an attacker to circumvent all of the existing defenses –under certain circumstances.</div><div><br></div><div>In this dissertation, we define and infer the Residual Attack Surface on a system. That is, we expose the limitations of the state-of-the-art mitigations, by showing practical ways to circumvent them. This work is divided into four parts. It assumes an attack with three phases and proposes new techniques to infer the Residual Attack Surface on each stage.</div><div><br></div><div>For the first part, we focus on the vulnerability discovery. We propose FuzzGen, a tool for automatically generating fuzzer stubs for libraries. The synthesized fuzzers are target specific, thus resulting in high code coverage. This enables developers to expose and fix vulnerabilities (that reside deep in the code and require initializing a complex state to trigger them), before they can be exploited. We then move to the vulnerability exploitation part and we present a novel technique called Block Oriented Programming (BOP), that automates data-only attacks. Data-only attacks defeat advanced control-flow hijacking defenses such as Control Flow Integrity. Our framework, called BOPC, maps arbitrary exploit payloads into execution traces and encodes them as a set of memory writes. Therefore an attacker’s intended execution “sticks” to the execution flow of the underlying binary and never departs from it. In the third part of the dissertation, we present an extension of BOPC that presents some measurements that give strong indications of what types of exploit payloads are not possible to execute. Therefore, BOPC enables developers to test what data an attacker would compromise and enables evaluation of the Residual Attack Surface to assess an application’s risk. Finally, for the last part, which is to achieve persistence on the compromised system, we present a new technique to construct arbitrary malware that evades current dynamic and behavioral analysis. The desired malware is split into hundreds (or thousands) of little pieces and each piece is injected into a different process. A special emulator coordinates and synchronizes the execution of all individual pieces, thus achieving a “distributed execution” under multiple address spaces. malWASH highlights weaknesses of current dynamic and behavioral analysis schemes and argues for full-system provenance.</div><div><br></div><div>Our envision is to expose all the weaknesses of the deployed mitigations, protections and defenses through the Residual Attack Surface. That way, we can help the research community to reinforce the existing defenses, or come up with new, more effective ones.</div>

Cette thèse en Informatique s'inscrit dans le cadre de gestion de la confiance et plus précisément des systèmes de recommandation. Ces systèmes sont généralement basés sur les retours d'expériences des utilisateurs (i.e., qualitatifs/quantitatifs) lors de l'utilisation des ressources sur le Web (ex. films, vidéos et service Web). Les systèmes de recommandation doivent faire face à trois types d'incertitude liés aux évaluations des utilisateurs, à leur identité et à la variation des performances des ressources au fil du temps. Nous proposons une approche robuste pour évaluer la confiance en tenant compte de ces incertitudes. Le premier type d'incertitude réfère aux évaluations. Cette incertitude provient de la vulnérabilité du système en présence d'utilisateurs malveillants fournissant des évaluations biaisées. Pour pallier cette incertitude, nous proposons un modèle flou de la crédibilité des évaluateurs. Ce modèle, basé sur la technique de clustering flou, permet de distinguer les utilisateurs malveillants des utilisateurs stricts habituellement exclus dans les approches existantes. Le deuxième type d'incertitude réfère à l'identité de l'utilisateur. En effet, un utilisateur malveillant a la possibilité de créer des identités virtuelles pour fournir plusieurs fausses évaluations. Pour contrecarrer ce type d'attaque dit Sybil, nous proposons un modèle de filtrage des évaluations, basé sur la crédibilité des utilisateurs et le graphe de confiance auquel ils appartiennent. Nous proposons deux mécanismes, l'un pour distribuer des capacités aux utilisateurs et l'autre pour sélectionner les utilisateurs à retenir lors de l'évaluation de la confiance. Le premier mécanisme permet de réduire le risque de faire intervenir des utilisateurs multi-identités. Le second mécanisme choisit des chemins dans le graphe de confiance contenant des utilisateurs avec des capacités maximales. Ces deux mécanismes utilisent la crédibilité des utilisateurs comme heuristique. Afin de lever l'incertitude sur l'aptitude d'une ressource à satisfaire les demandes des utilisateurs, nous proposons deux approches d'évaluation de la confiance d'une ressource sur leWeb, une déterministe et une probabiliste. La première consolide les différentes évaluations collectées en prenant en compte la crédibilité des évaluateurs. La deuxième s'appuie sur la théorie des bases de données probabilistes et la sémantique des mondes possibles. Les bases de données probabilistes offrent alors une meilleure représentation de l'incertitude sous-jacente à la crédibilité des utilisateurs et permettent aussi à travers des requêtes un calcul incertain de la confiance d'une ressource. Finalement, nous développons le système WRTrust (Web Resource Trust) implémentant notre approche d'évaluation de la confiance. Nous avons réalisé plusieurs expérimentations afin d'évaluer la performance et la robustesse de notre système. Les expérimentations ont montré une amélioration de la qualité de la confiance et de la robustesse du système aux attaques des utilisateurs malveillants / This thesis in Computer Science is part of the trust management field and more specifically recommendation systems. These systems are usually based on users’ experiences (i.e., qualitative / quantitative) interacting with Web resources (eg. Movies, videos and Web services). Recommender systems are undermined by three types of uncertainty that raise due to users’ ratings and identities that can be questioned and also due to variations in Web resources performance at run-time. We propose a robust approach for trust assessment under these uncertainties. The first type of uncertainty refers to users’ ratings. This uncertainty stems from the vulnerability of the system in the presence of malicious users providing false ratings. To tackle this uncertainty, we propose a fuzzy model for users’ credibility. This model uses a fuzzy clustering technique to distinguish between malicious users and strict users usually excluded in existing approaches. The second type of uncertainty refers to user’s identity. Indeed, a malicious user purposely creates virtual identities to provide false ratings. To tackle this type of attack known as Sybil, we propose a ratings filtering model based on the users’ credibility and the trust graph to which they belong. We propose two mechanisms, one for assigning capacities to users and the second one is for selecting users whose ratings will be retained when evaluating trust. The first mechanism reduces the attack capacity of Sybil users. The second mechanism chose paths in the trust graph including trusted users with maximum capacities. Both mechanisms use users’ credibility as heuristic. To deal with the uncertainty over the capacity of a Web resource in satisfying users’ requests, we propose two approaches for Web resources trust assessment, one deterministic and one probabilistic. The first consolidates users’ ratings taking into account users credibility values. The second relies on probability theory coupled with possible worlds semantics. Probabilistic databases offer a better representation of the uncertainty underlying users’ credibility and also permit an uncertain assessment of resources trust. Finally, we develop the system WRTrust (Web Resource Trust) implementing our trust assessment approach. We carried out several experiments to evaluate the performance and robustness of our system. The results show that trust quality has been significantly improved, as well as the system’s robustness in presence of false ratings attacks and Sybil attacks

When making new software systems, security testing should always be included in the process. In this thesis, attacks were identified and performed against a system consisting of two servers and an Android application. A penetration test was also performed against parts of the system. If an attack was successful, this was considered a vulnerability. The attacks that were identified and performed were a NoSQL injection attack a man-in-the-middle attack and reverse engineering. Through the man-in-the-middle attack and reverse engineering, breaching security properties such as confidentiality and integrity was possible. The NoSQL injection attack was not successful in breaching neither. No results from these could be used to exploit the system further. Countermeasures were taken to secure against the discovered vulnerabilities, and new instances of the attacks were performed after this as well. The overall conclusion is that the system is now secure against our implementations of the attacks performed in this thesis.

Dagens samhälle präglas av den växande digitaliseringen. Information flödar på alla håll och kanter, den bearbetas, lagras och kommuniceras konstant. Nuförtiden kan systemen byggas ganska säkra, men så fort man sätter en människa bakom tangentbordet introducerar man en rejäl sårbarhet och äventyrar att vår information hamnar i fel händer. SE (social engineering, social manipulering) är konsten att nyttja social interaktion som ett medel oavsett om det kräver ett tekniskt system eller övertygelse för att få tillgång till känslig information. Detta är en kvalitativ intervjustudie som försöker skildra hur penetrationstestare ser och arbetar med/mot SE (social engineering, social manipulering) sker. Studien tolkar penetrationstestares perspektiv på dagens sociala manipulerings angrepp, hur de arbetar med det och vad vi som individer kan göra för att skydda oss. Slutsatserna från studiens delfrågor hjälper att besvara studiens forskningsfråga “Hur ser penetrationstestare på dagens SE?” Studien visar på att majoriteten av respondenterna är överens om hur SE ser ut idag. Konklusionen visar på att angreppet “phishing” är en av de vanligaste angreppsformerna idag både trendmässigt och arbetsrelaterat just nu. Vidare skildrades även “varför sociala manipulatörer ofta lyckas med sina angrepp” vilket resulterade i att den psykologiska aspekten är ett av de viktigaste förbättringsområdena inom SE. Slutligen, redogjorde respondenterna viktiga skyddsåtgärder som kan tillämpas av både organisationer och privatpersoner. / Our modern World is filled with information everywhere. Information isconstantly processed, stored and communicated. However,we all know that information usuallyhas some value;therefore,we build secure and complex systems, whichare packed with data. Valuable data. Then we put humans behind those systems and introduce ahuge vulnerability and by that,we are risking our data falling into the wrong hands. Social engineering –it is used to deceive people and letting themgive up sensitive information. This qualitative interview study will attempt to disclose the perception of social engineering from people who perform penetration-testingservices. The results of the study are showing that participators are partially decided of their view of social engineering. They almost all agree that “phishing” is a common attack in bothinternet occurrences and in work-related matters. Furthermore, the conclusion shows that the psychological aspect of social engineering is an important improvement area. Lastly, the participants explain several preventative actions, whichcan be used by organizations and by individuals to minimize the risk of exposure to social engineering.

Fosfogesso é um resíduo sólido da produção de ácido fosfórico pelas indústrias de fertilizantes. A produção anual deste material no mundo é de cerca de 180 milhões de toneladas, e isto causa problemas com a sua armazenagem. O fosfogesso tem sido estudado para uso como material de construção de bases e sub-bases de pavimentos. O fosfogesso tem pouca durabilidade frente à ação da água quando sujeito somente à estabilização mecânica. O cimento Portland é então adicionado ao fosfogesso, resultando em misturas mais estáveis. A reação do aluminato tricálcico contido no cimento e dos sulfatos presentes no fosfogesso poderia conduzir à formação de cristais de etringita e à expansão subseqüente. O objetivo desta pesquisa é avaliar a influência do tipo de cimento na expansibilidade das misturas de fosfogesso e cimento para uso na construção de pavimentos. Analisou-se o comportamento expansivo de corpos de prova compactados com diferentes proporções de fosfogesso e cimento, variando-se o tipo de cimento, energia de compactação e período de cura. Para todos os cimentos usados nesta pesquisa, considerando-se o período de 84 dias de cura, a maior parte da expansão ocorreu nos primeiros 28 dias. A influência do tipo de cimento na expansão das misturas de fosfogesso e cimento é significante, mas o teor de aluminato tricálcico não é a única explicação para o comportamento de expansão observado neste estudo, visto que os resultados experimentais indicam que quantidades crescentes de aluminato tricálcico conduzem a menores expansões, fato que contraria a expectativa inicial desta pesquisa. / Phosphogypsum is a solid by-product resulting from the phosphoric acid process for manufacturing fertilizers. The annual worldwide production of this material is about 180 million de tons and it causes problems with its disposal. The phosphogypsum has been studied for use in pavement base and sub-base materials. Phosphogypsum has poor durability when subjected to mechanical stabilization only in wet conditions. The addition of stabilizing materials, such as Portland cement, is one method of overcoming this deficiency. The chemical reaction between tricalcium aluminate present in Portland cement and sulfate ions supplied by phosphogypsum could lead to the formation of ettringite and subsequent expansion. The objective of this research is to evaluate the influence of Portland cement type on the expansion of cement-stabilized phosphogypsum mixtures for use as pavement construction. The expansion behavior was analyzed through compacted specimens composed by different phosphogypsum and cement proportions, varying the cement type, compaction energy and curing period. For all cements used in this research, most of expansion occurred within the first 28 days in relation to the 84 days of curing. There is a significant influence of cement type on the expansion of the cement-stabilized phosphogypsum mixtures, but the aluminate tricalcium content is not the only explanation for the expansion behavior observed in this study. The experimental results show that an increasing amount of tricalcium aluminate yields lower expansion, fact that thwarts the initial expectation of this research.

Canais seguros, como os gerados pelos protocolos SSL e TLS, são cada vez mais utilizados nos serviços de rede para propiciar autenticação de parceiro, integridade e sigilo dos dados. Porém, sua utilização impede que um sistema de detecção de intrusão de rede possa observar o conteúdo dos pacotes, impossibilitando a análise das mensagens. Como alternativa de contorno deste problema é proposta a arquitetura de um agente de detecção, prevenção e contenção de ataques baseado em aplicação, que possibilite interceptar fluxos de mensagens diretamente na aplicação, inserido no contexto de uma arquitetura de detecção distribuída e padronizada. O ADACA (Agente de Detecção, Análise e Contenção de Ataques) é um agente IDS (Intrusion Detection System) híbrido capaz de operar tanto no modo ativo quanto passivo. Dessa forma, permite realizar a análise do conteúdo de mensagens que estejam protegidos por protocolos seguros, como o SSL e TLS, e adotar uma medida predefinida antes que a aplicação alvo processe um conteúdo malicioso. Além disso, o padrão de formato de mensagens de alertas IDMEF (Intrusion Detection Message Exchange Format), proposto pelo IDWG, é adotado para notificação de eventos do agente ADACA a um IDS central. Os resultados obtidos mostraram a viabilidade da utilização de agentes de aplicação, acoplados diretamente à aplicação, como complemento aos sistemas IDS de rede. / Secure channel, as the one generated by protocols like SSL and TLS, has been used on network services to provide partner authentication, integrity and confidentiality. However, its utilization prevents a network intrusion detection system to observe and analyze packets content. As an alternative to circumvent this problem, the present work proposes an agent-based intrusion detection, prevention and containment architecture capable to capture messages flows directly at the host application and introduce it on a distributed intrusion detection framework. The ADACA (Attack Detection, Analysis and Containment Agent) is a hybrid agent that can operate on active and passive mode. In this context, it is able to detect attacks where the application payload is encrypted by secure protocols, like SSL and TLS, and take some predefined measure before the host application process a malicious content. Further that, Intrusion Detection Message Exchange Format (IDMEF) standard proposed by IDWG is considered to send alerts between agent ADACA and an IDS central. The results shown that is practicable to use an application agent attached to an application as a complement of network intrusion detection systems.

O presente trabalho tem por objetivo investigar e propor uma metodologia rápida e eficaz de avaliação da reatividade do cimento Portland frente ao ataque por sulfatos. O método consiste na utilização de amostras de pasta de cimento hidratada em pó, colocadas em contato direto com soluções concentradas de Na2SO4 e MgSO4, em temperatura elevada (65ºC), para acelerar o ataque. Apesar dos cimentos estudados possuírem composição química parecida, os resultados de SO3 combinado mostraram que o cimento Classe G foi pouco menos suscetível ao ataque por sulfatos em função do maior teor de Fe2O3 presente. Da TG e DRX observou-se a formação de etringita no ataque por ambos os sais de sulfato; e formação de gipsita no ataque por MgSO4. Enquanto havia disponibilidade de portlandita na pasta hidratada, o cimento com adição mineral incorporada apresentou mesma taxa de ataque que os demais (sem adição), entretanto a partir do momento que toda a portlandita foi consumida, iniciou-se um processo de descalcificação do C-S-H, observado pela DRX. / The main point of this research is to propose a fast and effective method of evaluation of the cement reactivity to sulfate attack. Resistance to sulfate attack was measured by determining the combined sulfate in cement paste samples with exposure to Na2SO4 and MgSO4 solution, at high temperature (65°C). The samples of cement paste was triturated (powdered) in the proposed method. The results of combined SO3 showed that the Class G cement was little less susceptible to the sulfate attack because it has larger amount of Fe2O3. The ettringite formation was observed in the attack for both sulfate salts; and gypsum formation in the attack for MgSO4 (results of TG and XRD). The blended cement presented same results that the others, however when the Ca(OH)2 was totally consumed, it observed the decalcification of the C-S-H, by XRD.