New Chrome Encryption Extension Promises Better Privacy

Google now offers an extension for its Chrome browser designed to provide easy e-mail encryption to users. The company is touting the End-to-End extension for its simplicity of use compared to similar open source tools such as PGP and GnuPG. Google is basing End-to-End on the OpenPGP standard. The tool is in alpha, meaning the code is available for testing and evaluation now at https://code.google.com/p/end-to-end/source/checkout . Google also is offering bounties for any bugs found in End-to-End through its Vulnerability Reward Program. (Businessweek)(PC Mag)(TIME)(Google Online Security Blog)

View the original article here

Computers get a better way to detect threats

ScienceDaily (Sep. 20, 2012) — UT Dallas computer scientists have developed a technique to automatically allow one computer in a virtual network to monitor another for intrusions, viruses or anything else that could cause a computer to malfunction.

The technique has been dubbed "space travel" because it sends computer data to a world outside its home, and bridges the gap between computer hardware and software systems.

"Space travel might change the daily practice for many services offered virtually for cloud providers and data centers today, and as this technology becomes more popular in a few years, for the user at home on their desktop," said Dr. Zhiquian Lin, the research team's leader and an assistant professor of computer science in the Erik Jonsson School of Engineering and Computer Science.

As cloud computing is becoming more popular, new techniques to protect the systems must be developed. Since this type of computing is Internet-based, skilled computer specialists can control the main part of the system virtually -- using software to emulate hardware.

Lin and his team programmed space travel to use existing code to gather information in a computer's memory and automatically transfer it to a secure virtual machine -- one that is isolated and protected from outside interference.

"You have an exact copy of the operating system of the computer inside the secure virtual machine that a hacker can't compromise," Lin said. "Using this machine, then the user or antivirus software can understand what's happening with the space traveled computer setting off red flags if there is any intrusion.

Previously, software developer had to manually write such tools.

"With our technique, the tools already being used on the computer become part of the defense process," he said.

The gap between virtualized computer hardware and software operating on top of it was first characterized by Drs. Peter Chen and Brian Noble, faculty members from the University of Michigan.

"The ability to leverage existing code goes a long way in solving the gap problem inherent to many types of virtual machine services," said Chen, Arthur F. Thurnau Professor of Electrical Engineering and Computer Science, who first proposed the gap in 2001. "Fu and Lin have developed an interesting way to take existing code from a trusted system and automatically use it to detect intrusions."

Lin said the space travel technique will help the FBI understand what is happening inside a suspect's computer even if they are physically miles away, instead of having to buy expensive software.

Space travel was presented at the most recent IEEE Symposium on Security and Privacy. Lin developed this with Yangchun Fu, a research assistant in computer science.

"This is the top conference in cybersecurity, said Bhavani Thuraisingham, executive director of the UT Dallas Cyber Security Research and Education Center and a Louis A. Beecherl Jr. Distinguished Professor in the Jonsson School. "It is a major breakthrough that virtual developers no longer need to write any code to bridge the gap by using the technology invented by Dr. Lin and Mr. Fu. This research has given us tremendous visibility among the cybersecurity research community around the world."

Share this story on Facebook, Twitter, and Google:

Other social bookmarking and sharing tools:

Story Source:

The above story is reprinted from materials provided by University of Texas, Dallas.

Note: Materials may be edited for content and length. For further information, please contact the source cited above.

Note: If no author is given, the source is cited instead.

Disclaimer: Views expressed in this article do not necessarily reflect those of ScienceDaily or its staff.

View the original article here

Better security for web and mobile applications

ScienceDaily (July 20, 2012) — A team led by Harvard computer scientists, including two undergraduate students, has developed a new tool that could lead to increased security and enhanced performance for commonly used web and mobile applications.

Called RockSalt, the clever bit of code can verify that native computer programming languages comply with a particular security policy.

Presented at the ACM Conference on Programming Language Design and Implementation (PLDI) in Beijing, in June, RockSalt was created by Greg Morrisett, Allen B. Cutting Professor of Computer Science at the Harvard School of Engineering and Applied Sciences (SEAS), two of his undergraduate students Edward Gan '13 and Joseph Tassarotti '13, former postdoctoral fellow Jean-Baptiste Tristan (now at Oracle), and Gang Tan of Lehigh University.

"When a user opens an external application, such as Gmail or Angry Birds, web browsers such as Google Chrome typically run the program's code in an intermediate and safer language such as JavaScript," says Morrisett. "In many cases it would be preferable to run native machine code directly."

The use of native code, especially in an online environment, however, opens up the door to hackers who can exploit vulnerabilities and readily gain access to other parts of a computer or device. An initial solution to this problem was offered over a decade ago by computer scientists at the University of California, Berkeley, who developed software fault isolation (SFI).

SFI forces native code to "behave" by rewriting machine code to limit itself to functions that fall within particular parameters. This "sandbox process" sets up a contained environment for running native code. A separate "checker" program can then ensure that the executable code adheres to regulations before running the program.

While considered a major breakthrough, the solution was limited to devices using RISC chips, a processor more common in research than in consumer computing. In 2006, Morrisett developed a way to implement SFI on the more popular CISC-based chips, like the Intel x86 processor. The technique was adopted widely. Google modified the routine for Google Chrome, eventually developing it into Google Native Client (or "NaCl").

When bugs and vulnerabilities were found in the checker for NaCl, Google sent out a call to arms. Morrissett once again took on the challenge, turning the problem into an opportunity for his students. The result was RockSalt, an improvement over NaCl, built using Coq, a proof development system.

"We built a simple but incredibly powerful system for proving a hypothesis -- so powerful that it's likely to be overlooked. We want to prove that if the checker says 'yes,' the code will indeed respect the sandbox security policy," says Joseph Tassarotti '13, who built and tested a model of the execution of x86 instructions. "We wanted to get a guarantee that there are no bugs in the checker, so we set out to construct a rigorous, machine-checked proof that the checker is correct."

"Our proofs about the correctness of our own tool say that if you run the tool on a program, and it says it's safe to run, then according to the model, this program can only do certain things," Tassarotti adds. "Our proof, however, was only as good as this model. If the model was wrong, then the tool could potentially have an error."

In other words, he explains, think of an analogy in physics. While you might mathematically prove that according to Newton's laws, a moving object will follow a certain trajectory, the proof is only meaningful to the degree that Newton's laws accurately model the world.

"Since the x86 architecture is very complicated, it was essential to test the model by running programs on a real chip, then simulating them with the model, and seeing whether the results matched. I specified the meanings of many of these instructions and developed the testing infrastructure to check for errors in the model," Tassarotti says.

Even more impressively, RockSalt comprises a mere 80 lines of code, as compared to the 600 lines of the original Google native code checker. The new checker is also faster, and, to date, no vulnerabilities have been uncovered. The tool offers tremendous advantages to programmers and users alike, allowing programmers to code in any language, compile it to native executable code, and secure it without going through intermediate languages such as JavaScript, and even to cross back and forth between Java and native code. This allows coders to choose the benefits of multiple languages, such as using one to ensure portability while using others to enhance performance.

"The biggest benefit may be that users can have more peace of mind that a piece of software works as they want it to," says Morrisett. "For users, the impact of such a tool is slightly more tangible; it allows users to safely run, for example, games, in a web browser without the painfully slow speeds that translated code traditionally provides."

Previous efforts to develop a robust, error-free checker have resulted in some success, but RockSalt has the potential to be scaled to software widely used by the general public. The researchers expect that their tool might end up being adopted and integrated into future versions of common web browsers. Morrisett and his team also have plans to adapt the tool for use in a broader variety of processors.

Reflecting on how the class project has been transformative, Tassarotti says, "I plan to pursue a Ph.D. in computer science, and I hope to work on projects like this that can improve the correctness of software. As computers are so prevalent now in fields like avionics and medical devices, I believe that this type of research is essential to ensure safety."

Share this story on Facebook, Twitter, and Google:

Other social bookmarking and sharing tools:

Story Source:

The above story is reprinted from materials provided by Harvard University.

Note: Materials may be edited for content and length. For further information, please contact the source cited above.

Note: If no author is given, the source is cited instead.

Disclaimer: Views expressed in this article do not necessarily reflect those of ScienceDaily or its staff.

View the original article here

Artificial intelligence: Getting better at the age guessing game

ScienceDaily (Feb. 1, 2012) — The active learning algorithm is faster and more accurate in guessing the age of an individual than conventional algorithms.

Scientists are developing artificial intelligence solutions for image processing, which have applications in many areas including advertising, entertainment, education and healthcare. They have, for example, developed computer algorithms for facial age classification -- the automated assignment of individuals to predefined age groups based on their facial features as seen on video captures or still images.

Improving the accuracy of facial age classification, however, is not easy. A person can teach a computer to make better guesses by running its algorithm through a large database of facial images of which the age is known using sets of labeled images, but acquiring such a database can be both time-consuming and expensive. The process might even breach privacy in certain countries. Jian-Gang Wang at the A*STAR Institution for Infocomm Research and co-workers1 have now developed an algorithm called incremental bilateral two-dimensional linear discriminant analysis (IB2DLDA) that could overcome such problems.

The researchers designed IB2DLDA so that it actively 'learns'. The algorithm first processes a small pool of labeled images, and then iteratively selects the most informative samples from a large pool of unlabeled images to query the user, and the information is added to the training database. According to Wang, unlabeled images that are markedly different to the labeled samples are the most informative. The 'active learning' approach significantly improves the efficiency of the algorithm and reduces the number of samples that need to be labeled, and hence the time and effort required to program the computer.

Based on their new findings, the researchers hope that it will become easier to build facial age classification into intelligent machines. The technology could find use, for example, in digital signage where the machine determines the age group of the viewer and displays targeted advertisements designed for those age groups, or in interactive games where the machine automatically presents different games based on the players' age range. Wang adds, "A vending machine that can estimate the age of a buyer could be useful for products that involve age control, such as alcoholic drinks and cigarettes."

The researchers demonstrated that the active learning approach was much faster than random selection, and used only half the number of samples. The method is also suitable for handling problems with a large number of classes, and could one day be generalized to applications other than age estimation. "We are now planning to extend our method to other areas such as classifying human emotions and actions," says Wang.

The A*STAR-affiliated researchers contributing to this research are from the Institution for Infocomm Research.

Share this story on Facebook, Twitter, and Google:

Other social bookmarking and sharing tools:

Story Source:

The above story is reprinted from materials provided by The Agency for Science, Technology and Research (A*STAR), via ResearchSEA.

Note: Materials may be edited for content and length. For further information, please contact the source cited above.

Journal Reference:

Jian-Gang Wang, E Sung, Wei-Yun Yau. Active Learning for Solving the Incomplete Data Problem in Facial Age Classification by the Furthest Nearest-Neighbor Criterion. IEEE Transactions on Image Processing, 2011; 20 (7): 2049 DOI: 10.1109/TIP.2011.2106794

Note: If no author is given, the source is cited instead.

Disclaimer: Views expressed in this article do not necessarily reflect those of ScienceDaily or its staff.

View the original article here