Matching Items (27)
Filtering by
- All Subjects: Entrepreneurship
- All Subjects: Security
- Creators: Computer Science and Engineering Program
- Member of: Theses and Dissertations
- Status: Published
Description
After freelancing on my own for the past year and a half, I have realized that one of the biggest obstacles to college entrepreneurs is a fear or apprehension to sales. As a computer science major trying to sell my services, I discovered very quickly that I had not been prepared for the difficulty of learning sales. Sales get a bad rap and very often is the last thing that young entrepreneurs want to try, but the reality is that sales is oxygen to a company and a required skill for an entrepreneur. Due to this, I compiled all of my knowledge into an e-book for young entrepreneurs starting out to learn how to open up a conversation with a prospect all the way to closing them on the phone. Instead of starting from scratch like I did, college entrepreneurs can learn the bare basics of selling their own services, even if they are terrified of sales and what it entails. In this e-book, there are tips that I have learned to deal with my anxiety about sales such as taking the pressure off of yourself and prioritizing listening more than pitching. Instead of trying to teach sales expecting people to be natural sales people, this e-book takes the approach of helping entrepreneurs that are terrified of sales and show them how they can cope with this fear and still close a client. In the future, I hope young entrepreneurs will have access to more resources that handle this fear and make it much easier for them to learn it by themselves. This e-book is the first step.
ContributorsMead, Kevin Tyler (Author) / Sebold, Brent (Thesis director) / Kruse, Gabriel (Committee member) / Computer Science and Engineering Program (Contributor) / Barrett, The Honors College (Contributor)
Created2018-05
Description
Modern computer processors contain an embedded firmware known as microcode that controls decode and execution of x86 instructions. Although proprietary and relatively obscure, this microcode can be modified using updates released by hardware manufacturers to correct processor logic flaws (errata). At the same time, a malicious microcode update could compromise a processor by implementing new malicious instructions or altering the functionality of existing instructions, including processor-accelerated virtualization or cryptographic primitives. Not only is this attack vector capable of subverting all software-enforced security policies and access controls, but it also leaves behind no postmortem forensic evidence since the write-only patch memory is cleared upon system reset. Although supervisor privileges (ring zero) are required to update processor microcode, this attack cannot be easily mitigated due to the implementation of microcode update functionality within processor silicon. In this paper, we reveal the microarchitecture and mechanism of microcode updates, present a security analysis of this attack vector, and provide some mitigation suggestions.
ContributorsChen, Daming Dominic (Author) / Ahn, Gail-Joon (Thesis director) / Lee, Joohyung (Committee member) / Barrett, The Honors College (Contributor) / Computer Science and Engineering Program (Contributor) / School of International Letters and Cultures (Contributor) / School of Mathematical and Statistical Sciences (Contributor)
Created2014-05
Description
We discuss processes involved in user-centric security design, including the synthesis of goals based on security and usability tasks. We suggest the usage of implicit security and the facilitation of secureuser actions. We propose a process for evaluating usability flaws by treating them as security threats and adapting traditional HCI methods. We discuss how to correct these flaws once they are discovered. Finally, we discuss the Usable Security Development Model for developing usable secure systems.
ContributorsJorgensen, Jan Drake (Author) / Ahn, Gail-Joon (Thesis director) / VanLehn, Kurt (Committee member) / Wilkerson, Kelly (Committee member) / Barrett, The Honors College (Contributor) / Computer Science and Engineering Program (Contributor)
Created2013-05
Description
Radio Frequency Identification (RFID) technology allows objects to be identified electronically by way of a small electronic tag. RFID is quickly becoming quite popular, and there are many security hurdles for this technology to overcome. The iCLASS line of RFID, produced by HID Global, is one such technology that is widely used for secure access control and applications where a contactless authentication element is desirable. Unfortunately, iCLASS has been shown to have security issues. Nevertheless customers continue to use it because of the great cost that would be required to completely replace it. This Honors Thesis will address attacks against iCLASS and means for countering them that do not require such an overhaul.
ContributorsMellott, Matthew John (Author) / Ahn, Gail-Joon (Thesis director) / Thorstenson, Tina (Committee member) / Barrett, The Honors College (Contributor) / Computer Science and Engineering Program (Contributor)
Created2014-05
Description
IoT Media broadcast devices, such as the Roku stick, Amazon Fire, and Chromecast have been emerging onto the market recently as a portable and inexpensive alternative to cable and disk players, allowing easy integration between home and business Wi-Fi networks and television systems capable of supporting HDMI inputs without the additional overhead of setting up a heavy or complicated player or computer. The rapid expansion of these products as a mechanism to provide for TV Everywhere services for entertainment as well as cheap office appliances brings yet another node in the rapidly expanding network of IoT that surrounds us today. However, the security implications of these devices are nearly unexplored, despite their prevalence. In this thesis, I will go over the structure and mechanisms of Chromecast, and explore some of the potential exploits and consequences of the device. The thesis contains an overview of the inner workings of Chromecast, goes over the segregation and limited control and fundamental design choices of the Android based OS. It then identifies the objectives of security, four different potential methods of exploit to compromise those objectives on a Chromecast and/or its attached network, including rogue applications, traffic sniffing, evil access points and the most effective one: deauthentication attack. Tests or relevant analysis were carried out for each of these methods, and conclusions were drawn on their effectiveness. There is then a conclusion revolving around the consequences, mitigation and the future implications of security issues on Chromecast and the larger IoT landscape.
ContributorsHuang, Kaiyi (Author) / Zhao, Ziming (Thesis director) / Ahn, Gail-Joon (Committee member) / W. P. Carey School of Business (Contributor) / Computer Science and Engineering Program (Contributor) / Barrett, The Honors College (Contributor)
Created2016-12
Description
What if unplanned free time could be spent with friends instead of trying to contact them? This app will do that by connecting you with friends who are ready to hang out. Kickback is a mobile app designed to connect individuals with their friends and businesses that offer opportunities to socialize in a group setting. The idea had been floating around in my head for a few years and this creative project gave me the opportunity to try my hand at making the idea into a reality. This thesis is a combination of technical efforts and business know-how that I had to learn in order to keep up along the way.
ContributorsFegard, Nathan (Author) / Sebold, Brent (Thesis director) / Trujillo, Rhett (Committee member) / Computer Science and Engineering Program (Contributor) / Barrett, The Honors College (Contributor)
Created2018-05
Description
Third-party mixers are used to heighten the anonymity of Bitcoin users. The mixing techniques implemented by these tools are often untraceable on the blockchain, making them appealing to money launderers. This research aims to analyze mixers currently available on the deep web. In addition, an in-depth case study is done on an open-source bitcoin mixer known as Penguin Mixer. A local version of Penguin Mixer was used to visualize mixer behavior under specific scenarios. This study could lead to the identification of vulnerabilities in mixing tools and detection of these tools on the blockchain.
ContributorsPakki, Jaswant (Author) / Doupe, Adam (Thesis director) / Shoshitaishvili, Yan (Committee member) / Computer Science and Engineering Program (Contributor, Contributor) / Barrett, The Honors College (Contributor)
Created2018-12
Description
Despite the more tightly controlled permissions and Java framework used by most programs in the Android operating system, an attacker can use the same classic vulnerabilities that exist for traditional Linux binaries on the programs in the Android operating system. Some classic vulnerabilities include stack overows, string formats, and heap meta-information corruption. Through the exploitation of these vulnerabilities an attacker can hijack the execution ow of an application. After hijacking the execution ow, an attacker can then violate the con_dentiality, integrity, or availability of the operating system. Over the years, the operating systems and compliers have implemented a number of protections to prevent the exploitation of vulnerable programs. The most widely implemented protections include Non-eXecutable stack (NX Stack), Address Space Layout Randomization (ASLR), and Stack Canaries (Canaries). NX Stack protections prevent the injection and execution of arbitrary code through the use of a permissions framework within a program. Whereas, ASLR and Canaries rely on obfuscation techniques to protect control ow, which requires su_cient entropy between each execution. Early in the implementation of these protections in Linux, researchers discovered that without su_cient entropy between executions, ASLR and Canaries were easily bypassed. For example, the obfuscation techniques were useless in programs that ran continuously because the programs did not change the canaries or re-randomize the address space. Similarly, aws in the implementation of ASLR and Canaries in Android only re-randomizes the values after rebooting, which means the address space locations and canary values remain constant across the executions of an Android program. As a result, an attacker can hijack the control ow Android binaries that contain control ow vulnerabilities. The purpose of this paper is to expose these aws and the methodology used to verify their existence in Android versions 4.1 (Jelly Bean) through 8.0 (Oreo).
ContributorsGibbs, Wil (Author) / Doupe, Adam (Thesis director) / Shoshitaishvili, Yan (Committee member) / Barrett, The Honors College (Contributor) / Computer Science and Engineering Program (Contributor)
Created2018-12
Description
The main objective of this thesis is to describe and analyze Clippr, an ASU startup founded by four students: Adam Lynch, Eric Gottfried, Ty Sivley, and Thomas Carpaneto. This paper will describe the formation of Clippr as a business, analyze the work and reasoning for dissolving the business, and suggest three pivots that could increase the chances of success for the future of Clippr. These three pivots are: mini salons, a concierge service, and an online resource. The idea for Clippr came from Sam, the team's friend's experience within the cosmetology industry. Sam graduated from cosmetology school in Phoenix and started his career as an assistant, which is the most common entry level position within the industry. Assistants do not get to work with clients and primarily do chores around the salon so he was not gaining any valuable experience. Eventually Sam found a position at a salon in Flagstaff. Unfortunately, he was not scheduled enough hours to pay his rent which forced him to travel back to Phoenix to cut his friend's and family's hair to make ends meet. Sam is not alone experiencing these issues within the industry, they are a common trend throughout the cosmetology field. It was found that there is a clear problem that affects every stylist: they struggle to reap the benefits of their self-employment. Most stylists become independent contractors where they are constrained by the salon's management. They are generally forced to work during the salon's hours of operations, promote specific products, adhere to a dress code, and forfeit their clients information. On the other hand, freelance workers outside of salons do enjoy greater freedoms within their work but with significant hurdles to overcome. They have a much harder time building a client base and face prohibitive start-up costs that make it harder to break into the industry.
ContributorsGottfried, Eric (Co-author) / Lynch, Adam (Co-author) / Sebold, Brent (Thesis director) / Balasooriya, Janaka (Committee member) / Computer Science and Engineering Program (Contributor) / Electrical Engineering Program (Contributor) / Barrett, The Honors College (Contributor)
Created2017-12
Description
Node.js is an extremely popular development framework for web applications. The appeal of its event-driven, asynchronous flow and the convenience of JavaScript as its programming language have driven its rapid growth, and it is currently deployed by leading companies in retail, finance, and other important sectors. However, the tools currently available for Node.js developers to secure their applications against malicious attackers are notably scarce. While there has been a substantial amount of security tools created for web applications in many other languages such as PHP and Java, very little exists for Node.js applications. This could compromise private information belonging to companies such as PayPal and WalMart. We propose a tool to statically analyze Node.js web applications for five popular vulnerabilites: cross-site scripting, SQL injection, server-side request forgery, command injection, and code injection. We base our tool off of JSAI, a platform created to parse client-side JavaScript for security risks. JSAI is novel because of its configuration capabilities, which allow a user to choose between various analysis options at runtime in order to select the most thorough analysis with the least amount of processing time. We contribute to the development of our tool by rigorously analyzing and documenting vulnerable functions and objects in Node.js that are relevant to the vulnerabilities we have selected. We intend to use this documentation to build a robust Node.js static analysis tool and we hope that other developers will also incorporate this analysis into their Node.js security projects.
ContributorsWasserman, Jonathan Kanter (Author) / Doupe, Adam (Thesis director) / Ahn, Gail-Joon (Committee member) / Zhao, Ziming (Committee member) / School of Historical, Philosophical and Religious Studies (Contributor) / Computer Science and Engineering Program (Contributor) / Barrett, The Honors College (Contributor)
Created2017-05