Keynotes

How the Hardware undermines Software Security
Daniel Gruss, Graz University of Technology

Abstract — Today, software errors are almost the only source of security vulnerabilities. Imagine a world without any software errors - would today's systems be safe and secure? Unfortunately not. With attacks that skip abstraction layers we can exploit effects rooted deeply in our hardware. This attack gives an overview of these attacks by discussing three concrete examples that have caught widespread media attention (Meltdown, Spectre, and Rowhammer). Finally, we will discuss how we got into this situation and what we can learn from it.

Biography — Daniel Gruss (@lavados) is an Assistant Professor at Graz University of Technology. He finished his PhD with distinction in less than 3 years. He has been involved in teaching operating system undergraduate courses since 2010. Daniel's research focuses on software-based side-channel attacks that exploit timing differences in hardware and operating systems. He implemented the first remote fault attack running in a website, known as Rowhammer.js. He frequently speaks at top international venues, such as Black Hat, Usenix Security, IEEE S&P, ACM CCS, Chaos Communication Congress, and others. His research team was one of the teams that found the Meltdown and Spectre bugs published in early 2018.

Detecting Integrity Violations in Online Services Using Trusted Hardware
Peter Pietzuch, Imperial College London

Abstract — Internet users have become reliant on a swathe of online services for everyday tasks and expect them to uphold service integrity. However, data loss or corruption can happen despite service providers' best efforts. In such cases, users often have little recourse, even struggling to prove that an integrity violation has occurred. In this talk, I will describe how to use Intel SGX for the auditing of online services. I will present LibSEAL, a SEcure Audit Library that creates a non-repudiable audit log of service operations and checks invariants to discover violations of service integrity. LibSEAL acts as a drop-in replacement for TLS libraries used by services, and runs inside an SGX enclave to protect the integrity of the audit log. Logs are stored using an embedded relational database, which permits service invariant violations to be discovered through simple SQL queries. We evaluate LibSEAL with three services (Git, ownCloud, and Dropbox) and demonstrate that it is effective in discovering integrity violations.

Biography — Peter Pietzuch is a Professor at Imperial College London, where he leads the Large-scale Data & Systems (LSDS) group in the Department of Computing. His research focuses on the design and engineering of scalable, reliable and secure software systems, with a particular interest in performance, data management and security issues. Before joining Imperial College London, he was a post-doctoral fellow at Harvard University. He holds PhD and MA degrees from the University of Cambridge.

Call for Papers

Important dates

• Paper submission deadline: January 10, 2019 January 3, 2019 (AoE, UTC-12)
• Acceptance notification: February 7, 2019
• Final paper due: February 22, 2019
• Workshop: March 25, 2019

About EuroSec

The 12^th European Workshop on Systems Security (EuroSec) aims to bring together researchers, practitioners, system administrators, system programmers, and others interested in the latest advances in the security of computer systems and networks. The objective of the workshop is to discuss novel, practical, systems-oriented work. The workshop will precede the EuroSys 2019 conference.

EuroSec encourages systems security researchers to share early iterations of bleeding-edge ideas with the community, before they are further developed into full papers. Reciprocally, authors receive feedback to help steer and improve their research to its full potential. Many EuroSec papers later form the basis for full conference papers presented at one of the top venues in computer security.

Topics of Interest

EuroSec seeks contributions on all aspects of systems security. Topics of interest include (but are not limited to):

• New attacks, evasion techniques, and defenses
• Operating system security
• Mobile systems security
• Malicious code analysis and detection
• Web security
• Network security
• Reverse engineering and binary analysis
• Hardware security
• Virtual machines and hypervisors
• Trusted computing and its applications
• System security aspects of privacy
• Identity management and anonymity
• Systems-based forensics
• Automated techniques for vulnerability discovery, analysis, and exploitation
• Embedded system security
• Cybercrime ecosystem and economics (e.g., spam, phishing, clickfraud)
• Security of critical infrastructures

In accordance with the spirit of EuroSys, we also seek:

• Quantified or insightful experience with existing systems
• Reproduction or refutation of previous results
• Negative results and early ideas

Paper submissions

You are invited to submit papers of up to 6 pages, with 9-point font, in a two-column format, including figures, tables and references. Submitted papers must use the 2017 ACM sigconf proceedings template. You should not modify key aspects of the template, such as font face, spacing, etc. The template, as well as instructions on how to use it, can be found here.

All submissions will be reviewed by the Program Committee. Only original, novel work will be considered for publication. Accepted papers will be published in the Proceedings of EuroSec in the ACM Digital Library. One author of each accepted paper is required to attend the workshop and present the paper for it to be included in the proceedings.

Submissions should be made online at https://eurosec2019.sec.tu-bs.de.