Internet telephony has rapidly becoming an integral part of life. Due to its low incremental cost and the wide availability of voice over IP (VoIP) based services these services being used by nearly everyone. Today there are many VoIP applications available in the market, but most of them lack basic security features. Because people use VoIP services via public hotspots and shared local area networks these VoIP applications are vulnerable to attacks, such as eavesdropping. Today, there is a great need for VoIP applications with high quality security. MiniSIP is an open-source VoIP application platform, initially developed at KTH. High quality security has been a major focus of MiniSIP developments by several students, including the first public implementations of the secure real-time protocol (SRTP) and the Multimedia Key Exchange (MIKEY) protocol. MiniSIP implements secure end-to-end VoIP services. In addition, MiniSIP implements features such as dynamically choosing the most appropriate CODEC during a call, implementing calling policies, etc. However, it suffers from having a complicated GUI that requires the use of many libraries, rendering it both hard to build and hard support – both of which make it unsuitable for commercial purposes. Web browser plug-ins are shared libraries that users install to extend the functionality of their browser. For example, a plug-in can be used to display content that the browser itself cannot display natively. For example, Adobe's reader plugin displays PDF files directly within the web browser. Real Network’s Streaming video player utilizes a browser plug-in to provide support for live video streaming within a web page. Adobe’s Flash player plugin is required to load or view any Flash contents – such as video or animations. The goal of this thesis project is remove the problem of the existing MiniSIP GUIs by developing a Firefox browser plug-in for the MiniSIP application that will utilize a web-browser based GUI. The prototype that will be designed, implemented, and evaluated will implement an open-source VoIP application that is easy for a Firefox browser user to install and will be easy to use via a web interface. The long term goal is to facilitate an ordinary user to utilize VoIP communication via their web browser. A secondary goal is to re-use the code within MiniSIP, while using the web-browser to provide the GUI. / Internettelefoni har snabbt blivit en integrerad del av livet. På grund av dess låga marginalkostnaden och den breda tillgången på Röst över IP (VoIP) tjänster dessa tjänster används av nästan alla. Idag finns det många VoIP-applikationer som finns på marknaden, men de flesta av dem saknar grundläggande säkerhetsfunktioner. Eftersom människor använder VoIP tjänster via offentliga hotspots och delade lokala nätverk dessa VoIP-applikationer är sårbara för attacker, såsom avlyssning. Idag finns det ett stort behov av VoIP-applikationer med hög kvalitet säkerhet. MiniSIP är ett open-source VoIP-program plattform, ursprungligen utvecklats vid KTH. Hög kvalitet säkerhet har varit ett stort fokus på MiniSIP utvecklingen genom att flera studenter, däribland de första offentliga implementeringar av den säkra realtid protokoll (SRTP) och Multimedia Key Exchange (MIKEY) protokollet. MiniSIP implementerar säker början till slut VoIP tjänster. Dessutom genomför MiniSIP funktioner som dynamiskt välja den lämpligaste CODEC under ett samtal, genomföra samtalsstrategier, osv. Men lider den från att ha en komplicerad GUI som kräver användning av många bibliotek, vilket gör det både svårt att bygga och hård stöd - som båda gör det olämpligt för kommersiella ändamål. Webbläsare plug-ins delas bibliotek som användare installerar för att utöka funktionerna i sin webbläsare. Till exempel kan en plug-in kan användas för att visa innehåll som webbläsaren inte själv kan visa inföding. Till exempel visar Adobes Reader plugin PDF-filer direkt i webbläsaren. Real Networks strömmande videospelare använder en plugin-att ge stöd för levande video strömning i en webbsida. Adobe Flash Player plugin krävs för att ladda eller visa en Flash innehåll - såsom video eller animationer. Målet med denna avhandling projektet är bort problemet med befintliga MiniSIP GUI genom att utveckla en Firefox webbläsare plug-in för att MiniSIP programmet som kommer att använda en webbläsare baserad GUI. Prototypen som kommer att utformas, genomföras och utvärderas kommer att genomföra en öppen källkod VoIP-program som är lätt för en Firefox webbläsare användaren att installera och kommer att vara lätt att använda via ett webbgränssnitt. Det långsiktiga målet är att underlätta en vanlig användare att använda VoIP-kommunikation via sin webbläsare. En sekundär målsättning är att återanvända kod i MiniSIP, medan du använder webbläsare för att ge det grafiska gränssnittet.

Multi-factor authentication (MFA) offers a wide range of methods and techniques available today. The security benefits of using MFA are almost indisputable, however, users are reluctant to adopt the technology. While many new MFA solutions are being proposed, there is a lack of consideration for user sentiment in the early stages of development. In an attempt to balance security and usability, this report investigates the feasibility of a new authentication mechanism that uses browser fingerprinting, graphical passwords, and honeytokens. This was evaluated by conducting a limited literature review, producing a prototype, interviews with test users, and security experts, as well as ensuring feasibility through a requirements checklist. The results of this research provides evidence that this mechanism is feasible, and appealing to end users. However, more investigation is required in order to ensure the mechanism's viability in a real-world deployment.

Modern web-applications often need to be able to handle multi-window views that are dynamically synchronized depending on user input, as well as continuous and rapid data transfer between the client and the server. The WebSocket protocol has seen widespread industry use when it comes to bidirectional, real-time communication. However, its inherent security flaws make the prospect of other adequate alternatives highly relevant. SSE combined with XHR is a technology that has been overlooked by developers due to the shortcomings of the HTTP/1.1 protocol regarding efficiency. However, the HTTP/2 protocol expands upon and streamlines the core features of HTTP/1.1 while also providing full-duplex functionality. The introduction of the HTTP/2 protocol has given rise to speculations regarding a potential comeback for SSE as a viable contender for the WebSocket protocol. The aim is to evaluate whether the combination of SSE and XHR over HTTP/2 could be an equally or more efficient alternative to the WebSocket protocol for real-time data synchronization between multiple web-application views. This is done through the design and creation of two proof-of-concepts supported by the theoretical foundation established by conducting a literature review. The literature in this area indicates a lack of existing research concerning SSE over HTTP/2. The proof-of-concepts has produced empirical data, consisting of average data transmission times, that points to SSE/XHR performing as well as, if not better than the WebSocket counterpart. The results confirm that a combination of XHR and SSE over HTTP/2 is an adequate alternative to WebSockets within the scope of this study.

An IVDS (Interactive Video Data Service) uses an interactive television system to transmit data to and from subscribers' homes. IVDS allows the viewer to interact with content provided on the television using a remote control. A typical IVDS application would be ordering an advertised product or playing along with a quiz show. The Virginia Tech Center for Wireless Telecommunications (CWT), under a contract with Interactive Return Service, Inc., is developing an IVDS system in which content is provided through the television cable system in the form of audio codes. A special remote control can detected these audio codes and query the user for input. The return path for this system is a wireless channel. The remote control contains a spread spectrum transmitter that transmits packets to a Repeater unit residing within a quarter mile of the user's home. With the popularity of the World Wide Web soaring, many companies are announcing internet appliances that will bring the content of the web to the user at a fraction of the cost of a standard personal computer. CWT has been contracted to extend the core IVDS system to provide a web browsing capability, allowing the user to browse the web with only the remote control. This thesis outlines the requirements of the IVDS Web Browser System. The different hardware design concepts are documented. The final Browser System specification is presented, as well as a board-level description of the Decoder Unit that is part of this final Browser System. Finally, a detailed description, current status, and simulation results are presented for the FPGA (Field Programmable Gate Array) that serves as the controller for the Decoder Unit. / Master of Science

Le développement de l’Internet à haut débit et l’expansion du commerce électronique ont entraîné dans leur sillage de nouvelles attaques qui connaissent un vif succès. L’une d’entre elles est particulièrement sensible dans l’esprit collectif : celle qui s’en prend directement aux portefeuilles des Internautes. Sa version la plus répandue/connue est désignée sous le terme phishing. Majoritairement véhiculée par des campagnes de spam, cette attaque vise à voler des informations confidentielles (p.ex. identifiant, mot de passe, numéro de carte bancaire) aux utilisateurs en usurpant l’identité de sites marchands et/ou bancaires. Au fur et à mesure des années, ces attaques se sont perfectionnées jusqu’à proposer des sites webs contrefaits qui visuellement - hormis l’URL visitée - imitent à la perfection les sites originaux. Par manque de vigilance, bon nombre d’utilisateurs communiquent alors - en toute confiance - des données confidentielles. Dans une première partie de cette thèse, parmi les moyens de protection/détection existants face à ces attaques, nous nous intéressons à un mécanisme facile d’accès pour l’Internaute : les barres d’outils anti-phishing, à intégrer dans le navigateur web. La détection réalisée par ces barres d’outils s’appuie sur l’utilisation de listes noires et tests heuristiques. Parmi l’ensemble des tests heuristiques utilisés (qu’ils portent sur l’URL ou le contenu de la page web), nous cherchons à évaluer leur utilité et/ou efficacité à identifier/différencier les sites légitimes des sites de phishing. Ce travail permet notamment de distinguer les heuristiques décisifs, tout en discutant de leur pérennité. Une deuxième variante moins connue de cette attaque - le pharming - peut être considérée comme une version sophistiquée du phishing. L’objectif de l’attaque reste identique, le site web visité est tout aussi ressemblant à l’original mais - a contrario du phishing - l’URL visitée est cette fois-ci elle aussi totalement identique à l’originale. Réalisées grâce à une corruption DNS amont, ces attaques ont l’avantage de ne nécessiter aucune action de communication de la part de l’attaquant : celui-ci n’a en effet qu’à attendre la visite de l’Internaute sur son site habituel. L’absence de signes "visibles" rend donc l’attaque perpétrée particulièrement efficace et redoutable, même pour un Internaute vigilant. Certes les efforts déployés côté réseau sont considérables pour répondre à cette problématique. Néanmoins, le côté client y reste encore trop exposé et vulnérable. Dans une deuxième partie de cette thèse, par le développement de deux propositions visant à s’intégrer dans le navigateur client, nous introduisons une technique de détection de ces attaques qui couple une analyse de réponses DNS à une comparaison de pages webs. Ces deux propositions s’appuient sur l’utilisation d’éléments de référence obtenus via un serveur DNS alternatif, leur principale différence résidant dans la technique de récupération de la page web de référence. Grâce à deux phases d’expérimentation, nous démontrons la viabilité du concept proposé. / The development of online transactions and "always-connected" broadband Internet access is a great improvement for Internet users, who can now benefit from easy access to many services, regardless of the time or their location. The main drawback of this new market place is to attract attackers looking for easy and rapid profits. One major threat is known as a phishing attack. By using website forgery to spoof the identity of a company that proposes financial services, phishing attacks trick Internet users into revealing confidential information (e.g. login, password, credit card number). Because most of the end-users check the legitimacy of a login website by looking at the visual aspect of the webpage displayed by the web browser - with no consideration for the visited URL or the presence and positioning of security components -, attackers capitalize on this weakness and design near-perfect copies of legitimate websites, displayed through a fraudulent URL. To attract as many victims as possible, most of the time phishing attacks are carried out through spam campaigns. One popular method for detecting phishing attacks is to integrate an anti-phishing protection into the web browser of the user (i.e. anti-phishing toolbar), which makes use of two kinds of classification methods : blacklists and heuristic tests. The first part of this thesis consists of a study of the effectiveness and the value of heuristics tests in differentiating legitimate from fraudulent websites. We conclude by identifying the decisive heuristics as well as discussing about their life span. In more sophisticated versions of phishing attacks - i.e. pharming attacks -, the threat is imperceptible to the user : the visited URL is the legitimate one and the visual aspect of the fake website is very similar to the original one. As a result, pharming attacks are particularly effective and difficult to detect. They are carried out by exploiting DNS vulnerabilities at the client-side, in the ISP (Internet Service Provider) network or at the server-side. While many efforts aim to address this problem in the ISP network and at the server-side, the client-side remains excessively exposed. In the second part of this thesis, we introduce two approaches - intended to be integrated into the client’s web browser - to detect pharming attacks at the client-side. These approaches combine both an IP address check and a webpage content analysis, performed using the information provided by multiple DNS servers. Their main difference lies in the method of retrieving the webpage which is used for the comparison. By performing two sets of experimentations, we validate our concept.

Tor hidden services are anonymous servers of unknown location and ownership who can be accessed through any Tor-enabled web browser. They have gained popularity over the years, but still suer from major usability challenges due to their cryptographicallygenerated non-memorable addresses. In response to this difficulty, in this work we introduce the Onion Name System (OnioNS), a privacy-enhanced distributed DNS that allows users to reference a hidden service by a meaningful globally-unique veriable domain name chosen by the hidden service operator. We introduce a new distributed self-healing public ledger and construct OnioNS as an optional backwards-compatible plugin for Tor on top of existing hidden service infrastructure. We simplify our design and threat model by embedding OnioNS within the Tor network and provide mechanisms for authenticated denial-of-existence with minimal networking costs. Our reference implementation demonstrates that OnioNS successfully addresses the major usability issue that has been with Tor hidden services since their introduction in 2002.

Background. Web tracking is a constant threat to our privacy when browsing the web. There exist multiple methods of tracking, but browser fingerprinting is more elusive and difficult to control. Browser fingerprinting works by a website collecting all kinds of browser and system information on visiting clients and then combining those into one set of information that can uniquely identify users. Objectives. In this thesis, we tested three of today's most used web browsers for the desktop platform to determine their ability to utilize one type of countermeasure, attribute spoofing. We aimed at determining how the browsers perform in two cases. The first case is when running with a default configuration. The second case is when the attribute spoofing is improved with the help of both altered settings and installed extensions. We also aimed at determining if the choice of browser matters in this aspect. Methods. The method for determining these goals was to conduct an experiment to collect 60 fingerprints from each browser and determine the effectiveness of the attribute spoofing via a weight-based system. We also used statistics to see the value range for spoofed attributes and to determine if any browser restart is required for certain spoofing to occur. Results. Our results show little to no attribute spoofing when browsers run in their default configuration. However, significant improvements were made through anti-fingerprint extensions. Conclusions. Our conclusion is, if the tested browsers' do not utilize any other type of countermeasure than attribute spoofing, using browsers at their default configuration can result in a user being alarmingly vulnerable to browser fingerprinting. Installing extensions aimed at improving our protection is therefore advised.

The validation approach for assuring quality of software does often include the conduction of tests. Software testing includes a wide range of methodology depending on the system level and the component under test. Graphical user interface (GUI) testing consists of high level tests that assert that functions and design element in user interfaces work as expected. The research conducted in this paper focused on GUI testing of web based applications and the movement towards automated testing within the software industry. The question which formed the basis for the study was the following: How should a generic test automation framework be designed in order to allow maintenance between developers and non-developers? The study was conducted on a Swedish consultant company that provides e-commerce web solutions. A work strategy approach for automated testing was identified and an automation framework prototype was produced. The framework was evaluated through a pilot study where testers participated through the creation of a test suite for a specific GUI testing area. Time estimations were collected as well as qualitative measurements through a follow up survey. This paper presents a work strategy proposal for automated tests together with description of the framework system design. The results are presented with a subsequent discussion about the benefits and complexity of creating and introducing automated tests within large scale systems. Future work suggestions are also addressed together with accountancy of the frameworks usefulness for other testing areas besides GUI testing.

Phishing campaigns continue to deceive users into revealing their credentials, despite advancing spam filters, browser and toolbar warnings, and educational efforts. Recently, researchers have begun investigating how fake credentials --- or honeytokens --- can be used to detect phishing sites and protect users. BogusBiter, one such work, creates sets of honeytokens based on users' real credentials and sends them alongside real user submissions to phishing sites. In this paper, we present Phish Feeder, an anti-phishing tool which extends the BogusBiter honeytoken generation algorithm in order to create more realistic and authentic-looking credentials. Phish Feeder also employs a ``honeytoken repository'' which stores generated credentials and provides a lookup service for legitimate sites that encounter invalid credentials. The Phish Feeder client is implemented as a Firefox extension and the repository is implemented as a Java web application. We compare the effectiveness of the Phish Feeder generation algorithm to that of the previous work and find that it is up to four times as effective at hiding real users' credentials within a set. Furthermore, we find that Phish Feeder introduces only negligible overhead during normal browsing, and a low overhead during credential creation and submission.

<p> Browsers are used as a medium to perform various activities on the Internet and mobile applications are used on mobile devices. They let users connect to the Internet and access different services such as sending emails, watching videos, using banking services, etc. The increase in the usage of the Internet, personal computers, and mobile phones led financial institutions to democratize their services and provide omnipresent and cost-effective services to their customers, in turn attracting a large customer base. Many of these financial institu?tions store and manage sensitive user information such as account numbers and usernames, passwords, Social Security Numbers (SSNs), etc. Due to the nature of the sensitive infor?mation that these institutions manage, it makes a perfect bait for attackers to exploit and perform cyber attacks. Most of the forensic and security research observed in the bank?ing ecosystem focused on foreign financial institutions and mobile banking applications for Android. However, no forensic research has been conducted on the mobile and browser ap?plications of US financial institutions. In this research, I performed a forensic analysis on both browser and mobile applications (both Android and iOS) of US financial institutions. I conducted a forensic investigation on the JP Morgan Chase (Chase), Purdue Federal Credit Union (PFCU), Discover, and CapitalOne banks. This research found what information these banking applications store locally and where they store them to assist digital forensic investigators in investigations. </p>