text:
Moia, Vitor Hugo Galhardo; Breitinger, Frank; é, Marco Aur
Understanding the effects of removing common blocks on Approximate Matching scores under different scenarios for digital forensic investigations Inproceedings
Anais do XIX Simpósio Brasileiro em Segurança da Informaç~ao e de Sistemas Computacionais, SBC 2019, (bf Best Paper Award).
Abstract | BibTeX
@inproceedings{MBH19,
title = {Understanding the effects of removing common blocks on Approximate Matching scores under different scenarios for digital forensic investigations},
author = {Vitor Hugo Galhardo Moia and Frank Breitinger and Marco Aur é},
booktitle = {Anais do XIX Simpósio Brasileiro em Segurança da Informaç~ao e de Sistemas Computacionais},
organization = {SBC},
abstract = {Finding similarity in digital forensics investigations can be assisted with the use of Approximate Matching (AM) functions. These algorithms create small and compact representations of objects (similar to hashes) which can be compared to identify similarity. However, often results are biased due to common blocks (data structures found in many different files regardless of content). In this paper, we evaluate the precision and recall metrics for AM functions when removing common blocks. In detail, we analyze how the similarity score changes and impacts different investigation scenarios. Results show that many irrelevant matches can be filtered out and that a new interpretation of the score allows a better similarity detection.},
Finding similarity in digital forensics investigations can be assisted with the use of Approximate Matching (AM) functions. These algorithms create small and compact representations of objects (similar to hashes) which can be compared to identify similarity. However, often results are biased due to common blocks (data structures found in many different files regardless of content). In this paper, we evaluate the precision and recall metrics for AM functions when removing common blocks. In detail, we analyze how the similarity score changes and impacts different investigation scenarios. Results show that many irrelevant matches can be filtered out and that a new interpretation of the score allows a better similarity detection.
Wu, Tina; Breitinger, Frank; Baggili, Ibrahim
IoT Ignorance is Digital Forensics Research Bliss: A Survey to Understand IoT Forensics Definitions, Challenges and Future Research Directions Inproceedings
Proceedings of the 14th International Conference on Availability, Reliability and Security, pp. 46:1–46:15, ACM, Canterbury, CA, United Kingdom, 2019, ISBN: 978-1-4503-7164-3.
@inproceedings{WBB19,
title = {IoT Ignorance is Digital Forensics Research Bliss: A Survey to Understand IoT Forensics Definitions, Challenges and Future Research Directions},
author = {Tina Wu and Frank Breitinger and Ibrahim Baggili},
booktitle = {Proceedings of the 14th International Conference on Availability, Reliability and Security},
pages = {46:1--46:15},
address = {Canterbury, CA, United Kingdom},
series = {ARES '19},
http://doi.acm.org/10.1145/3339252.3340504
Haigh, Trevor; Breitinger, Frank; Baggili, Ibrahim
If I Had a Million Cryptos: Cryptowallet Application Analysis and a Trojan Proof-of-Concept Inproceedings
Breitinger, Frank; Baggili, Ibrahim (Ed.): Digital Forensics and Cyber Crime, pp. 45–65, Springer International Publishing, Cham, 2018, ISBN: 978-3-030-05487-8, (bf Best Paper Award).
@inproceedings{HBB19,
title = {If I Had a Million Cryptos: Cryptowallet Application Analysis and a Trojan Proof-of-Concept},
author = {Trevor Haigh and Frank Breitinger and Ibrahim Baggili},
booktitle = {Digital Forensics and Cyber Crime},
abstract = {Cryptocurrencies have gained wide adoption by enthusiasts and investors. In this work, we examine seven different Android cryptowallet applications for forensic artifacts, but we also assess their security against tampering and reverse engineering. Some of the biggest benefits of cryptocurrency is its security and relative anonymity. For this reason it is vital that wallet applications share the same properties. Our work, however, indicates that this is not the case. Five of the seven applications we tested do not implement basic security measures against reverse engineering. Three of the applications stored sensitive information, like wallet private keys, insecurely and one was able to be decrypted with some effort. One of the applications did not require root access to retrieve the data. We were also able to implement a proof-of-concept trojan which exemplifies how a malicious actor may exploit the lack of security in these applications and exfiltrate user data and cryptocurrency.},
Cryptocurrencies have gained wide adoption by enthusiasts and investors. In this work, we examine seven different Android cryptowallet applications for forensic artifacts, but we also assess their security against tampering and reverse engineering. Some of the biggest benefits of cryptocurrency is its security and relative anonymity. For this reason it is vital that wallet applications share the same properties. Our work, however, indicates that this is not the case. Five of the seven applications we tested do not implement basic security measures against reverse engineering. Three of the applications stored sensitive information, like wallet private keys, insecurely and one was able to be decrypted with some effort. One of the applications did not require root access to retrieve the data. We were also able to implement a proof-of-concept trojan which exemplifies how a malicious actor may exploit the lack of security in these applications and exfiltrate user data and cryptocurrency.
doi:10.1007/978-3-030-05487-8_3
Schmicker, Robert; Breitinger, Frank; Baggili, Ibrahim
AndroParse - An Android Feature Extraction Framework and Dataset Inproceedings
Breitinger, Frank; Baggili, Ibrahim (Ed.): Digital Forensics and Cyber Crime, pp. 66–88, Springer International Publishing, Cham, 2018, ISBN: 978-3-030-05487-8.
@inproceedings{SBB19,
title = {AndroParse - An Android Feature Extraction Framework and Dataset},
author = {Robert Schmicker and Frank Breitinger and Ibrahim Baggili},
abstract = {Android malware has become a major challenge. As a consequence, practitioners and researchers spend a significant time analyzing Android applications (APK). A common procedure (especially for data scientists) is to extract features such as permissions, APIs or strings which can then be analyzed. Current state of the art tools have three major issues: (1) a single tool cannot extract all the significant features used by scientists and practitioners (2) Current tools are not designed to be extensible and (3) Existing parsers can be timely as they are not runtime efficient or scalable. Therefore, this work presents AndroParse which is an open-source Android parser written in Golang that currently extracts the four most common features: Permissions, APIs, Strings and Intents. AndroParse outputs JSON files as they can easily be used by most major programming languages. Constructing the parser allowed us to create an extensive feature dataset which can be accessed by our independent REST API. Our dataset currently has 67,703 benign and 46,683 malicious APK samples.},
Android malware has become a major challenge. As a consequence, practitioners and researchers spend a significant time analyzing Android applications (APK). A common procedure (especially for data scientists) is to extract features such as permissions, APIs or strings which can then be analyzed. Current state of the art tools have three major issues: (1) a single tool cannot extract all the significant features used by scientists and practitioners (2) Current tools are not designed to be extensible and (3) Existing parsers can be timely as they are not runtime efficient or scalable. Therefore, this work presents AndroParse which is an open-source Android parser written in Golang that currently extracts the four most common features: Permissions, APIs, Strings and Intents. AndroParse outputs JSON files as they can easily be used by most major programming languages. Constructing the parser allowed us to create an extensive feature dataset which can be accessed by our independent REST API. Our dataset currently has 67,703 benign and 46,683 malicious APK samples.
Luciano, Laoise; Baggili, Ibrahim; Topor, Mateusz; Casey, Peter; Breitinger, Frank
Digital Forensics in the Next Five Years Inproceedings
Proceedings of the 13th International Conference on Availability, Reliability and Security, pp. 46:1–46:14, ACM, Hamburg, Germany, 2018, ISBN: 978-1-4503-6448-5.
@inproceedings{LBT18,
title = {Digital Forensics in the Next Five Years},
author = {Laoise Luciano and Ibrahim Baggili and Mateusz Topor and Peter Casey and Frank Breitinger},
address = {Hamburg, Germany},
series = {ARES 2018},
abstract = {Cyber forensics has encountered major obstacles over the last decade and is at a crossroads. This paper presents data that was obtained during the National Workshop on Redefining Cyber Forensics (NWRCF) on May 23-24, 2017 supported by the National Science Foundation and organized by the University of New Haven. Qualitative and quantitative data were analyzed from twenty-four cyber forensics expert panel members. This work identified important themes that need to be addressed by the community, focusing on (1) where the domain currently is; (2) where it needs to go and; (3) steps needed to improve it. Furthermore, based on the results, we articulate (1) the biggest anticipated challenges the domain will face in the next five years; (2) the most important cyber forensics research opportunities in the next five years and; (3) the most important job-ready skills that need to be addressed by higher education curricula over the next five years. Lastly, we present the key issues and recommendations deliberated by the expert panel. Overall results indicated that a more active and coherent group needs to be formed in the cyber forensics community, with opportunities for continuous reassessment and improvement processes in place.},
Cyber forensics has encountered major obstacles over the last decade and is at a crossroads. This paper presents data that was obtained during the National Workshop on Redefining Cyber Forensics (NWRCF) on May 23-24, 2017 supported by the National Science Foundation and organized by the University of New Haven. Qualitative and quantitative data were analyzed from twenty-four cyber forensics expert panel members. This work identified important themes that need to be addressed by the community, focusing on (1) where the domain currently is; (2) where it needs to go and; (3) steps needed to improve it. Furthermore, based on the results, we articulate (1) the biggest anticipated challenges the domain will face in the next five years; (2) the most important cyber forensics research opportunities in the next five years and; (3) the most important job-ready skills that need to be addressed by higher education curricula over the next five years. Lastly, we present the key issues and recommendations deliberated by the expert panel. Overall results indicated that a more active and coherent group needs to be formed in the cyber forensics community, with opportunities for continuous reassessment and improvement processes in place.
Liebler, Lorenz; Breitinger, Frank
mrsh-mem: Approximate Matching on Raw Memory Dumps Inproceedings
2018 11th International Conference on IT Security Incident Management IT Forensics (IMF), pp. 47-64, 2018.
@inproceedings{LB18,
title = {mrsh-mem: Approximate Matching on Raw Memory Dumps},
author = {Lorenz Liebler and Frank Breitinger},
doi = {10.1109/IMF.2018.00011},
booktitle = {2018 11th International Conference on IT Security Incident Management IT Forensics (IMF)},
abstract = {This paper presents the fusion of two subdomains of digital forensics: (1) raw memory analysis and (2) approximate matching. Specifically, this paper describes a prototype implementation named MRSH-MEM that allows to compare hard drive images as well as memory dumps and therefore can answer the question if a particular program (installed on a hard drive) is currently running / loaded in memory. To answer this question, we only require both dumps or access to a public repository which provides the binaries to be tested. For our prototype, we modified an existing approximate matching algorithm named MRSH-NET and combined it with approxis, an approximate disassembler. Recent literature claims that approximate matching techniques are slow and hardly applicable to the field of memory forensics. Especially legitimate changes to executables in memory caused by the loader itself prevent the application of current bytewise approximate matching techniques. Our approach lowers the impact of modified code in memory and shows a good computational performance. During our experiments, we show how an investigator can leverage meaningful insights by combining data gained from a hard disk image and raw memory dumps with a practicability runtime performance. Lastly, our current implementation will be integrable into the Volatility memory forensics framework and we introduce new possibilities for providing data driven cross validation functions. Our current proof of concept implementation supports Linux based raw memory dumps.},
This paper presents the fusion of two subdomains of digital forensics: (1) raw memory analysis and (2) approximate matching. Specifically, this paper describes a prototype implementation named MRSH-MEM that allows to compare hard drive images as well as memory dumps and therefore can answer the question if a particular program (installed on a hard drive) is currently running / loaded in memory. To answer this question, we only require both dumps or access to a public repository which provides the binaries to be tested. For our prototype, we modified an existing approximate matching algorithm named MRSH-NET and combined it with approxis, an approximate disassembler. Recent literature claims that approximate matching techniques are slow and hardly applicable to the field of memory forensics. Especially legitimate changes to executables in memory caused by the loader itself prevent the application of current bytewise approximate matching techniques. Our approach lowers the impact of modified code in memory and shows a good computational performance. During our experiments, we show how an investigator can leverage meaningful insights by combining data gained from a hard disk image and raw memory dumps with a practicability runtime performance. Lastly, our current implementation will be integrable into the Volatility memory forensics framework and we introduce new possibilities for providing data driven cross validation functions. Our current proof of concept implementation supports Linux based raw memory dumps.
doi:10.1109/IMF.2018.00011
Lillis, David; Breitinger, Frank; Scanlon, Mark
Expediting MRSH-v2 Approximate Matching with Hierarchical Bloom Filter Trees Inproceedings
Matoušek, Petr; Schmiedecker, Martin (Ed.): Digital Forensics and Cyber Crime, pp. 144–157, Springer International Publishing, Cham, 2018, ISBN: 978-3-319-73697-6, (bf Best Paper Award).
@inproceedings{LBS18,
title = {Expediting MRSH-v2 Approximate Matching with Hierarchical Bloom Filter Trees},
author = {David Lillis and Frank Breitinger and Mark Scanlon},
editor = {Petr Matoušek and Martin Schmiedecker},
doi = {10.1007/978-3-319-73697-6_11},
abstract = {Perhaps the most common task encountered by digital forensic investigators consists of searching through a seized device for pertinent data. Frequently, an investigator will be in possession of a collection of ``known-illegal'' files (e.g. a collection of child pornographic images) and will seek to find whether copies of these are stored on the seized drive. Traditional hash matching techniques can efficiently find files that precisely match. However, these will fail in the case of merged files, embedded files, partial files, or if a file has been changed in any way.},
Perhaps the most common task encountered by digital forensic investigators consists of searching through a seized device for pertinent data. Frequently, an investigator will be in possession of a collection of ``known-illegal'' files (e.g. a collection of child pornographic images) and will seek to find whether copies of these are stored on the seized drive. Traditional hash matching techniques can efficiently find files that precisely match. However, these will fail in the case of merged files, embedded files, partial files, or if a file has been changed in any way.
doi:10.1007/978-3-319-73697-6_11
Knieriem, Brandon; Zhang, Xiaolu; Levine, Philip; Breitinger, Frank; Baggili, Ibrahim
An Overview of the Usage of Default Passwords Inproceedings
Matoušek, Petr; Schmiedecker, Martin (Ed.): Digital Forensics and Cyber Crime, pp. 195–203, Springer International Publishing, Cham, 2018, ISBN: 978-3-319-73697-6.
@inproceedings{KZL18,
title = {An Overview of the Usage of Default Passwords},
author = {Brandon Knieriem and Xiaolu Zhang and Philip Levine and Frank Breitinger and Ibrahim Baggili},
abstract = {The recent Mirai botnet attack demonstrated the danger of using default passwords and showed it is still a major problem. In this study we investigated several common applications and their password policies. Specifically, we analyzed if these applications: (1) have default passwords or (2) allow the user to set a weak password (i.e., they do not properly enforce a password policy). Our study shows that default passwords are still a significant problem: 61% of applications inspected initially used a default or blank password. When changing the password, 58% allowed a blank password, 35% allowed a weak password of 1 character.},
The recent Mirai botnet attack demonstrated the danger of using default passwords and showed it is still a major problem. In this study we investigated several common applications and their password policies. Specifically, we analyzed if these applications: (1) have default passwords or (2) allow the user to set a weak password (i.e., they do not properly enforce a password policy). Our study shows that default passwords are still a significant problem: 61% of applications inspected initially used a default or blank password. When changing the password, 58% allowed a blank password, 35% allowed a weak password of 1 character.
Meffert, Christopher; Clark, Devon; Baggili, Ibrahim; Breitinger, Frank
Forensic State Acquisition from Internet of Things (FSAIoT): A General Framework and Practical Approach for IoT Forensics Through IoT Device State Acquisition Inproceedings
Proceedings of the 12th International Conference on Availability, Reliability and Security, pp. 56:1–56:11, ACM, Reggio Calabria, Italy, 2017, ISBN: 978-1-4503-5257-4.
@inproceedings{MCBB17,
title = {Forensic State Acquisition from Internet of Things (FSAIoT): A General Framework and Practical Approach for IoT Forensics Through IoT Device State Acquisition},
author = {Christopher Meffert and Devon Clark and Ibrahim Baggili and Frank Breitinger},
address = {Reggio Calabria, Italy},
abstract = {IoT device forensics is a difficult problem given that manufactured IoT devices are not standardized, many store little to no historical data, and are always connected; making them extremely volatile. The goal of this paper was to address these challenges by presenting a primary account for a general framework and practical approach we term Forensic State Acquisition from Internet of Things (FSAIoT). We argue that by leveraging the acquisition of the state of IoT devices (e.g. if an IoT lock is open or locked), it becomes possible to paint a clear picture of events that have occurred. To this end, FSAIoT consists of a centralized Forensic State Acquisition Controller (FSAC) employed in three state collection modes: controller to IoT device, controller to cloud, and controller to controller. We present a proof of concept implementation using openHAB -- a device agnostic open source IoT device controller -- and self-created scripts, to resemble a FSAC implementation. Our proof of concept employed an Insteon IP Camera as a controller to device test, an Insteon Hub as a controller to controller test, and a nest thermostat for a a controller to cloud test. Our findings show that it is possible to practically pull forensically relevant state data from IoT devices. Future work and open research problems are shared.},
IoT device forensics is a difficult problem given that manufactured IoT devices are not standardized, many store little to no historical data, and are always connected; making them extremely volatile. The goal of this paper was to address these challenges by presenting a primary account for a general framework and practical approach we term Forensic State Acquisition from Internet of Things (FSAIoT). We argue that by leveraging the acquisition of the state of IoT devices (e.g. if an IoT lock is open or locked), it becomes possible to paint a clear picture of events that have occurred. To this end, FSAIoT consists of a centralized Forensic State Acquisition Controller (FSAC) employed in three state collection modes: controller to IoT device, controller to cloud, and controller to controller. We present a proof of concept implementation using openHAB -- a device agnostic open source IoT device controller -- and self-created scripts, to resemble a FSAC implementation. Our proof of concept employed an Insteon IP Camera as a controller to device test, an Insteon Hub as a controller to controller test, and a nest thermostat for a a controller to cloud test. Our findings show that it is possible to practically pull forensically relevant state data from IoT devices. Future work and open research problems are shared.
Gupta, Vikas; Breitinger, Frank
How Cuckoo Filter Can Improve Existing Approximate Matching Techniques Inproceedings
James, JoshuaI.; Breitinger, Frank (Ed.): Digital Forensics and Cyber Crime, pp. 39-52, Springer International Publishing, 2015, ISBN: 978-3-319-25511-8, (bf Best Paper Award).
@inproceedings{GB15,
title = {How Cuckoo Filter Can Improve Existing Approximate Matching Techniques},
author = {Vikas Gupta and Frank Breitinger},
editor = {JoshuaI. James and Frank Breitinger},
abstract = {In recent years, approximate matching algorithms have become an important component in digital forensic research and have been adopted in some other working areas as well. Currently there are several approaches but especially sdhash and mrsh-v2 attract the attention of the community because of their good overall performance (runtime, compression and detection rates). Although both approaches have a quite different proceeding, their final output (the similarity digest) is very similar as both utilize Bloom filters. This data structure was presented in 1970 and thus has been around for a while. Recently, a new data structure was proposed and claimed to be faster and have a smaller memory footprint than Bloom filter -- Cuckoo filter.
In this paper we analyze the feasibility of Cuckoo filter for approximate matching algorithms and present a prototype implementation called mrsh-cf which is based on a special version of mrsh-v2 called mrsh-net. We demonstrate that by using Cuckoo filter there is a runtime improvement of approximately 37% and also a significantly better false positive rate. The memory footprint of mrsh-cf is 8 times smaller than mrsh-net, while the compression rate is twice than Bloom filter based fingerprint.},
In recent years, approximate matching algorithms have become an important component in digital forensic research and have been adopted in some other working areas as well. Currently there are several approaches but especially sdhash and mrsh-v2 attract the attention of the community because of their good overall performance (runtime, compression and detection rates). Although both approaches have a quite different proceeding, their final output (the similarity digest) is very similar as both utilize Bloom filters. This data structure was presented in 1970 and thus has been around for a while. Recently, a new data structure was proposed and claimed to be faster and have a smaller memory footprint than Bloom filter -- Cuckoo filter.
In this paper we analyze the feasibility of Cuckoo filter for approximate matching algorithms and present a prototype implementation called mrsh-cf which is based on a special version of mrsh-v2 called mrsh-net. We demonstrate that by using Cuckoo filter there is a runtime improvement of approximately 37% and also a significantly better false positive rate. The memory footprint of mrsh-cf is 8 times smaller than mrsh-net, while the compression rate is twice than Bloom filter based fingerprint.
Baggili, Ibrahim; Oduru, Jeff; Anthony, Kyle; Breitinger, Frank; McGee, Glenn
Watch What You Wear: Preliminary Forensic Analysis of Smart Watches Inproceedings
Availability, Reliability and Security (ARES), 2015 10th International Conference on, pp. 303-311, 2015.
@inproceedings{BOA15,
title = {Watch What You Wear: Preliminary Forensic Analysis of Smart Watches},
author = {Ibrahim Baggili and Jeff Oduru and Kyle Anthony and Frank Breitinger and Glenn McGee},
doi = {10.1109/ARES.2015.39},
booktitle = {Availability, Reliability and Security (ARES), 2015 10th International Conference on},
abstract = {This work presents preliminary forensic analysis of two popular smart watches, the Samsung Gear 2 Neo and LG G. These wearable computing devices have the form factor of watches and sync with smart phones to display notifications, track footsteps and record voice messages. We posit that as smart watches are adopted by more users, the potential for them becoming a haven for digital evidence will increase thus providing utility for this preliminary work. In our work, we examined the forensic artifacts that are left on a Samsung Galaxy S4 Active phone that was used to sync with the Samsung Gear 2 Neo watch and the LG G watch. We further outline a methodology for physically acquiring data from the watches after gaining root access to them. Our results show that we can recover a swath of digital evidence directly form the watches when compared to the data on the phone that is synced with the watches. Furthermore, to root the LG G watch, the watch has to be reset to its factory settings which is alarming because the process may delete data of forensic relevance. Although this method is forensically intrusive, it may be used for acquiring data from already rooted LG watches. It is our observation that the data at the core of the functionality of at least the two tested smart watches, messages, health and fitness data, e-mails, contacts, events and notifications are accessible directly from the acquired images of the watches, which affirms our claim that the forensic value of evidence from smart watches is worthy of further study and should be investigated both at a high level and with greater specificity and granularity.},
This work presents preliminary forensic analysis of two popular smart watches, the Samsung Gear 2 Neo and LG G. These wearable computing devices have the form factor of watches and sync with smart phones to display notifications, track footsteps and record voice messages. We posit that as smart watches are adopted by more users, the potential for them becoming a haven for digital evidence will increase thus providing utility for this preliminary work. In our work, we examined the forensic artifacts that are left on a Samsung Galaxy S4 Active phone that was used to sync with the Samsung Gear 2 Neo watch and the LG G watch. We further outline a methodology for physically acquiring data from the watches after gaining root access to them. Our results show that we can recover a swath of digital evidence directly form the watches when compared to the data on the phone that is synced with the watches. Furthermore, to root the LG G watch, the watch has to be reset to its factory settings which is alarming because the process may delete data of forensic relevance. Although this method is forensically intrusive, it may be used for acquiring data from already rooted LG watches. It is our observation that the data at the core of the functionality of at least the two tested smart watches, messages, health and fitness data, e-mails, contacts, events and notifications are accessible directly from the acquired images of the watches, which affirms our claim that the forensic value of evidence from smart watches is worthy of further study and should be investigated both at a high level and with greater specificity and granularity.
doi:10.1109/ARES.2015.39
Rathgeb, Christian; Breitinger, Frank; Baier, Harald; Busch, Christoph
Towards Bloom filter-based indexing of iris biometric data Inproceedings
Biometrics (ICB), 2015 International Conference on, pp. 422–429, IEEE 2015, (bf Siew-Sngiem Best Poster Award).
title = {Towards Bloom filter-based indexing of iris biometric data},
author = {Christian Rathgeb and Frank Breitinger and Harald Baier and Christoph Busch},
doi = {10.1109/ICB.2015.7139105},
booktitle = {Biometrics (ICB), 2015 International Conference on},
abstract = {Conventional biometric identification systems require exhaustive 1 : N comparisons in order to identify a bio- metric probe, i.e. comparison time frequently dominates the overall computational workload. Biometric database indexing represents a challenging task since biometric data does not exhibit any natural sorting order. In this paper we present a preliminary study on the feasibility of applying Bloom filters for the purpose of iris biometric database indexing. It is shown that, by constructing a binary tree data structure of Bloom filters extracted from binary iris biometric templates (iris-codes), the search space can be reduced to O(log N ). In experiments, which are carried out on a medium-sized database of N = 256 subjects, biometric performance (accuracy) is maintained for different conventional identification systems. Further, perspectives on how to employ the proposed scheme on large-scale databases are given.},
note = {bf Siew-Sngiem Best Poster Award},
Conventional biometric identification systems require exhaustive 1 : N comparisons in order to identify a bio- metric probe, i.e. comparison time frequently dominates the overall computational workload. Biometric database indexing represents a challenging task since biometric data does not exhibit any natural sorting order. In this paper we present a preliminary study on the feasibility of applying Bloom filters for the purpose of iris biometric database indexing. It is shown that, by constructing a binary tree data structure of Bloom filters extracted from binary iris biometric templates (iris-codes), the search space can be reduced to O(log N ). In experiments, which are carried out on a medium-sized database of N = 256 subjects, biometric performance (accuracy) is maintained for different conventional identification systems. Further, perspectives on how to employ the proposed scheme on large-scale databases are given.
doi:10.1109/ICB.2015.7139105
Satyendra, Gurjar; Baggili, Ibrahim; Breitinger, Frank; Fischer, Alice
An empirical comparison of widely adopted hash functions in digital forensics: does the programming language and operating system make a difference? Inproceedings
Proceedings of the Conference on Digital Forensics, Security and Law, pp. 57–68, 2015.
@inproceedings{SBBF15,
title = {An empirical comparison of widely adopted hash functions in digital forensics: does the programming language and operating system make a difference?},
author = {Gurjar Satyendra and Ibrahim Baggili and Frank Breitinger and Alice Fischer},
url = {https://commons.erau.edu/adfsl/2015/tuesday/6/},
booktitle = {Proceedings of the Conference on Digital Forensics, Security and Law},
abstract = {Hash functions are widespread in computer sciences and have a wide range of applications such as ensuring integrity in cryptographic protocols, structuring database entries (hash tables) or identifying known files in forensic investigations. Besides their cryptographic requirements, a fundamental property of hash functions is efficient and easy computation which is especially important in digital forensics due to the large amount of data that need to be processed in cases. In this paper, we correlate the runtime efficiency of common hashing algorithms (MD5, SHA-family) and their implementation. Our empirical comparison focuses on C-OpenSSL, Python, Ruby, Java on Windows and Linux and C‰ and WinCrypto API on Windows. The purpose of this paper is to recommend appropriate programming languages and libraries for coding tools that include intensive hashing functionality. In each programming language, we compute the MD5, SHA-1, SHA-256 and SHA-512 digest on datasets from 2 MB to 1 GB. For each language, algorithm and data, we perform multiple runs and compute the average elapsed time. In our experiment, we observed that OpenSSL and languages utilizing OpenSSL (Python and Ruby) perform better across all the hashing algorithms and data sizes on Windows and Linux. However, on Windows, performance of Java (Oracle JDK) and C WinCrypto is comparable to OpenSSL and better for SHA-512.},
Hash functions are widespread in computer sciences and have a wide range of applications such as ensuring integrity in cryptographic protocols, structuring database entries (hash tables) or identifying known files in forensic investigations. Besides their cryptographic requirements, a fundamental property of hash functions is efficient and easy computation which is especially important in digital forensics due to the large amount of data that need to be processed in cases. In this paper, we correlate the runtime efficiency of common hashing algorithms (MD5, SHA-family) and their implementation. Our empirical comparison focuses on C-OpenSSL, Python, Ruby, Java on Windows and Linux and C‰ and WinCrypto API on Windows. The purpose of this paper is to recommend appropriate programming languages and libraries for coding tools that include intensive hashing functionality. In each programming language, we compute the MD5, SHA-1, SHA-256 and SHA-512 digest on datasets from 2 MB to 1 GB. For each language, algorithm and data, we perform multiple runs and compute the average elapsed time. In our experiment, we observed that OpenSSL and languages utilizing OpenSSL (Python and Ruby) perform better across all the hashing algorithms and data sizes on Windows and Linux. However, on Windows, performance of Java (Oracle JDK) and C WinCrypto is comparable to OpenSSL and better for SHA-512.
https://commons.erau.edu/adfsl/2015/tuesday/6/
Baggili, Ibrahim; Breitinger, Frank
Data Sources for Advancing Cyber Forensics: What the Social World Has to Offer Inproceedings
AAAI Spring Symposium Series, 2015.
@inproceedings{BB15c,
title = {Data Sources for Advancing Cyber Forensics: What the Social World Has to Offer},
author = {Ibrahim Baggili and Frank Breitinger},
url = {http://aaai.org/ocs/index.php/SSS/SSS15/paper/view/10227},
booktitle = {AAAI Spring Symposium Series},
abstract = {Cyber forensics is fairly new as a scientific discipline and deals with the acquisition, authentication and analysis of digital evidence. One of the biggest challenges in this domain has thus far been real data sources that are available for experimentation. Only a few data sources exist at the time writing of this paper. The authors in this paper deliberate how social media data sources may impact future directions in cyber forensics, and describe how these data sources may be used as new digital forensic artifacts in future investigations. The authors also deliberate how the scientific community may leverage publically accessible social media data to advance the state of the art in Cyber Forensics.},
Cyber forensics is fairly new as a scientific discipline and deals with the acquisition, authentication and analysis of digital evidence. One of the biggest challenges in this domain has thus far been real data sources that are available for experimentation. Only a few data sources exist at the time writing of this paper. The authors in this paper deliberate how social media data sources may impact future directions in cyber forensics, and describe how these data sources may be used as new digital forensic artifacts in future investigations. The authors also deliberate how the scientific community may leverage publically accessible social media data to advance the state of the art in Cyber Forensics.
http://aaai.org/ocs/index.php/SSS/SSS15/paper/view/10227
@inproceedings{BB15d,
Breitinger, Frank; Liu, Huajian; Winter, Christian; Baier, Harald; Rybalchenko, Alexey; Steinebach, Martin
Towards a Process Model for Hash Functions in Digital Forensics Inproceedings
Gladyshev, Pavel; Marrington, Andrew; Baggili, Ibrahim (Ed.): Digital Forensics and Cyber Crime, pp. 170-186, Springer International Publishing, 2014, ISBN: 978-3-319-14288-3.
@inproceedings{BLW14,
title = {Towards a Process Model for Hash Functions in Digital Forensics},
author = {Frank Breitinger and Huajian Liu and Christian Winter and Harald Baier and Alexey Rybalchenko and Martin Steinebach},
editor = {Pavel Gladyshev and Andrew Marrington and Ibrahim Baggili},
url = {http://dx.doi.org/10.1007/978-3-319-14289-0_12},
abstract = {Handling forensic investigations gets more and more difficult as the amount of data one has to analyze is increasing continuously. A common approach for automated file identification are hash functions. The proceeding is quite simple: a tool hashes all files of a seized device and compares them against a database. Depending on the database, this allows to discard non-relevant (whitelisting) or detect suspicious files (blacklisting). One can distinguish three kinds of algorithms: (cryptographic) hash functions, bytewise approximate matching and semantic approximate matching (a.k.a perceptual hashing) where the main difference is the operation level. The latter one operates on the semantic level while both other approaches consider the byte-level. Hence, investigators have three different approaches at hand to analyze a device. First, this paper gives a comprehensive overview of existing approaches for bytewise and semantic approximate matching (for semantic we focus on images functions). Second, we compare implementations and summarize the strengths and weaknesses of all approaches. Third, we show how to integrate these functions based on a sample use case into one existing process model, the computer forensics field triage process model.},
Handling forensic investigations gets more and more difficult as the amount of data one has to analyze is increasing continuously. A common approach for automated file identification are hash functions. The proceeding is quite simple: a tool hashes all files of a seized device and compares them against a database. Depending on the database, this allows to discard non-relevant (whitelisting) or detect suspicious files (blacklisting). One can distinguish three kinds of algorithms: (cryptographic) hash functions, bytewise approximate matching and semantic approximate matching (a.k.a perceptual hashing) where the main difference is the operation level. The latter one operates on the semantic level while both other approaches consider the byte-level. Hence, investigators have three different approaches at hand to analyze a device. First, this paper gives a comprehensive overview of existing approaches for bytewise and semantic approximate matching (for semantic we focus on images functions). Second, we compare implementations and summarize the strengths and weaknesses of all approaches. Third, we show how to integrate these functions based on a sample use case into one existing process model, the computer forensics field triage process model.
http://dx.doi.org/10.1007/978-3-319-14289-0_12
Breitinger, Frank; Ziroff, Georg; Lange, Steffen; Baier, Harald
Similarity Hashing Based on Levenshtein Distances Inproceedings
Peterson, Gilbert; Shenoi, Sujeet (Ed.): Advances in Digital Forensics X, pp. 133-147, Springer Berlin Heidelberg, 2014, ISBN: 978-3-662-44951-6.
@inproceedings{BZLB14,
title = {Similarity Hashing Based on Levenshtein Distances},
author = {Frank Breitinger and Georg Ziroff and Steffen Lange and Harald Baier},
editor = {Gilbert Peterson and Sujeet Shenoi},
booktitle = {Advances in Digital Forensics X},
publisher = {Springer Berlin Heidelberg},
series = {IFIP Advances in Information and Communication Technology},
abstract = {It is increasingly common in forensic investigations to use automated pre-processing techniques to reduce the massive volumes of data that are encountered. This is typically accomplished by comparing fingerprints (typically cryptographic hashes) of files against existing databases. In addition to finding exact matches of cryptographic hashes, it is necessary to find approximate matches corresponding to similar files, such as different versions of a given file.
This paper presents a new stand-alone similarity hashing approach called saHash, which has a modular design and operates in linear time. saHash is almost as fast as SHA-1 and more efficient than other approaches for approximate matching. The similarity hashing algorithm uses four sub-hash functions, each producing its own hash value. The four sub-hashes are concatenated to produce the final hash value. This modularity enables sub-hash functions to be added or removed, e.g., if an exploit for a sub-hash function is discovered. Given the hash values of two byte sequences, saHash returns a lower bound on the number of Levenshtein operations between the two byte sequences as their similarity score. The robustness of saHash is verified by comparing it with other approximate matching approaches such as sdhash.},
It is increasingly common in forensic investigations to use automated pre-processing techniques to reduce the massive volumes of data that are encountered. This is typically accomplished by comparing fingerprints (typically cryptographic hashes) of files against existing databases. In addition to finding exact matches of cryptographic hashes, it is necessary to find approximate matches corresponding to similar files, such as different versions of a given file.
This paper presents a new stand-alone similarity hashing approach called saHash, which has a modular design and operates in linear time. saHash is almost as fast as SHA-1 and more efficient than other approaches for approximate matching. The similarity hashing algorithm uses four sub-hash functions, each producing its own hash value. The four sub-hashes are concatenated to produce the final hash value. This modularity enables sub-hash functions to be added or removed, e.g., if an exploit for a sub-hash function is discovered. Given the hash values of two byte sequences, saHash returns a lower bound on the number of Levenshtein operations between the two byte sequences as their similarity score. The robustness of saHash is verified by comparing it with other approximate matching approaches such as sdhash.
Breitinger, Frank; Winter, Christian; Yannikos, York; Fink, Tobias; Seefried, Michael
Using Approximate Matching to Reduce the Volume of Digital Data Inproceedings
@inproceedings{BWY14,
title = {Using Approximate Matching to Reduce the Volume of Digital Data},
author = {Frank Breitinger and Christian Winter and York Yannikos and Tobias Fink and Michael Seefried},
abstract = {Digital forensic investigators frequently have to search for relevant files in massive digital corpora -- a task often compared to finding a needle in a haystack. To address this challenge, investigators typically apply cryptographic hash functions to identify known files. However, cryptographic hashing only allows the detection of files that exactly match the known file hash values or fingerprints. This paper demonstrates the benefits of using approximate matching to locate relevant files. The experiments described in this paper used three test images of Windows XP, Windows 7 and Ubuntu 12.04 systems to evaluate fingerprint-based comparisons. The results reveal that approximate matching can improve file identification -- in one case, increasing the identification rate from 1.82% to 23.76%.},
Digital forensic investigators frequently have to search for relevant files in massive digital corpora -- a task often compared to finding a needle in a haystack. To address this challenge, investigators typically apply cryptographic hash functions to identify known files. However, cryptographic hashing only allows the detection of files that exactly match the known file hash values or fingerprints. This paper demonstrates the benefits of using approximate matching to locate relevant files. The experiments described in this paper used three test images of Windows XP, Windows 7 and Ubuntu 12.04 systems to evaluate fingerprint-based comparisons. The results reveal that approximate matching can improve file identification -- in one case, increasing the identification rate from 1.82% to 23.76%.
Breitinger, Frank; Baier, Harald
Similarity Preserving Hashing: Eligible Properties and a New Algorithm MRSH-v2 Inproceedings
Rogers, Marcus; Seigfried-Spellar, KathrynC. (Ed.): Digital Forensics and Cyber Crime, pp. 167-182, Springer Berlin Heidelberg, 2013, ISBN: 978-3-642-39890-2.
title = {Similarity Preserving Hashing: Eligible Properties and a New Algorithm MRSH-v2},
author = {Frank Breitinger and Harald Baier},
editor = {Marcus Rogers and KathrynC. Seigfried-Spellar},
abstract = {Hash functions are a widespread class of functions in computer science and used in several applications, e.g. in computer forensics to identify known files. One basic property of cryptographic hash func- tions is the avalanche effect that causes a significantly different output if an input is changed slightly. As some applications also need to identify similar files (e.g. spam/virus detection) this raised the need for similarity preserving hashing. In recent years, several approaches came up, all with different namings, properties, strengths and weaknesses which is due to a missing definition.
Based on the properties and use cases of traditional hash functions this paper discusses a uniform naming and properties which is a first step towards a suitable definition of similarity preserving hashing. Additionally, we extend the algorithm MRSH for similarity preserving hashing to its successor MRSH-v2, which has three specialties. First, it fulfills all our proposed defining properties, second, it outperforms existing approaches especially with respect to run time performance and third it has two detections modes. The regular mode of MRSH-v2 is used to identify similar files whereas the f-mode is optimal for fragment detection, i.e. to identify similar parts of a file.},
Hash functions are a widespread class of functions in computer science and used in several applications, e.g. in computer forensics to identify known files. One basic property of cryptographic hash func- tions is the avalanche effect that causes a significantly different output if an input is changed slightly. As some applications also need to identify similar files (e.g. spam/virus detection) this raised the need for similarity preserving hashing. In recent years, several approaches came up, all with different namings, properties, strengths and weaknesses which is due to a missing definition.
Based on the properties and use cases of traditional hash functions this paper discusses a uniform naming and properties which is a first step towards a suitable definition of similarity preserving hashing. Additionally, we extend the algorithm MRSH for similarity preserving hashing to its successor MRSH-v2, which has three specialties. First, it fulfills all our proposed defining properties, second, it outperforms existing approaches especially with respect to run time performance and third it has two detections modes. The regular mode of MRSH-v2 is used to identify similar files whereas the f-mode is optimal for fragment detection, i.e. to identify similar parts of a file.
Rathgeb, Christian; Breitinger, Frank; Busch, Christoph
Alignment-free cancelable iris biometric templates based on adaptive bloom filters Inproceedings
Biometrics (ICB), 2013 International Conference on, pp. 1-8, 2013.
@inproceedings{RBB13,
title = {Alignment-free cancelable iris biometric templates based on adaptive bloom filters},
author = {Christian Rathgeb and Frank Breitinger and Christoph Busch},
url = {http://dx.doi.org/10.1109/ICB.2013.6612976},
abstract = {Biometric characteristics are largely immutable, i.e. unprotected storage of biometric data provokes serious privacy threats, e.g. identity theft, limited re-newability, or cross-matching. In accordance with the ISO/IEC 24745 standard, technologies of cancelable biometrics offer solutions to biometric information protection by obscuring biometric signal in a non-invertible manner, while biometric comparisons are still feasible in the transformed domain. In the presented work alignment-free cancelable iris biometrics based on adaptive Bloom filters are proposed. Bloom filter-based representations of binary biometric templates (iris-codes) enable an efficient alignment-invariant biometric comparison while a successive mapping of parts of a binary biometric template to a Bloom filter represents an irreversible transform. In experiments, which are carried out on the CASIA - v 3 iris database, it is demonstrated that the proposed system maintains biometric performance for diverse iris recognition algorithms, protecting biometric templates at high security levels.},
Biometric characteristics are largely immutable, i.e. unprotected storage of biometric data provokes serious privacy threats, e.g. identity theft, limited re-newability, or cross-matching. In accordance with the ISO/IEC 24745 standard, technologies of cancelable biometrics offer solutions to biometric information protection by obscuring biometric signal in a non-invertible manner, while biometric comparisons are still feasible in the transformed domain. In the presented work alignment-free cancelable iris biometrics based on adaptive Bloom filters are proposed. Bloom filter-based representations of binary biometric templates (iris-codes) enable an efficient alignment-invariant biometric comparison while a successive mapping of parts of a binary biometric template to a Bloom filter represents an irreversible transform. In experiments, which are carried out on the CASIA - v 3 iris database, it is demonstrated that the proposed system maintains biometric performance for diverse iris recognition algorithms, protecting biometric templates at high security levels.
http://dx.doi.org/10.1109/ICB.2013.6612976
Breitinger, Frank; ø, Knut Asteb; Baier, Harald; Busch, Christoph
mvHash-B - A New Approach for Similarity Preserving Hashing Inproceedings
IT Security Incident Management and IT Forensics (IMF), 2013 Seventh International Conference on, pp. 33-44, 2013.
@inproceedings{BABB13,
title = {mvHash-B - A New Approach for Similarity Preserving Hashing},
author = {Frank Breitinger and Knut Asteb ø and Harald Baier and Christoph Busch},
url = {http://dx.doi.org/10.1109/IMF.2013.18},
doi = {10.1109/IMF.2013.18},
booktitle = {IT Security Incident Management and IT Forensics (IMF), 2013 Seventh International Conference on},
abstract = {The handling of hundreds of thousands of files is a major challenge in today's IT forensic investigations. In order to cope with this information overload, investigators use fingerprints (hash values) to identify known files automatically using blacklists or whitelists. Besides detecting exact duplicates it is helpful to locate similar files by using similarity preserving hashing (SPH), too. We present a new algorithm for similarity preserving hashing. It is based on the idea of majority voting in conjunction with run length encoding to compress the input data and uses Bloom filters to represent the fingerprint. It is therefore called mvHash-B. Our assessment shows that mvHash-B is superior to other SPHs with respect to run time efficiency: It is almost as fast as SHA-1 and thus faster than any other SPH algorithm. Additionally the hash value length is approximately 0.5% of the input length and hence outperforms most existing algorithms. Finally, we show that the robustness of mvHash-B against active manipulation is sufficient for practical purposes.},
The handling of hundreds of thousands of files is a major challenge in today's IT forensic investigations. In order to cope with this information overload, investigators use fingerprints (hash values) to identify known files automatically using blacklists or whitelists. Besides detecting exact duplicates it is helpful to locate similar files by using similarity preserving hashing (SPH), too. We present a new algorithm for similarity preserving hashing. It is based on the idea of majority voting in conjunction with run length encoding to compress the input data and uses Bloom filters to represent the fingerprint. It is therefore called mvHash-B. Our assessment shows that mvHash-B is superior to other SPHs with respect to run time efficiency: It is almost as fast as SHA-1 and thus faster than any other SPH algorithm. Additionally the hash value length is approximately 0.5% of the input length and hence outperforms most existing algorithms. Finally, we show that the robustness of mvHash-B against active manipulation is sufficient for practical purposes.
http://dx.doi.org/10.1109/IMF.2013.18
doi:10.1109/IMF.2013.18
Breitinger, Frank; Petrov, Kaloyan
Reducing the Time Required for Hashing Operations Inproceedings
Peterson, Gilbert; Shenoi, Sujeet (Ed.): Advances in Digital Forensics IX, pp. 101-117, Springer Berlin Heidelberg, 2013, ISBN: 978-3-642-41147-2.
@inproceedings{BK13,
title = {Reducing the Time Required for Hashing Operations},
author = {Frank Breitinger and Kaloyan Petrov},
booktitle = {Advances in Digital Forensics IX},
abstract = {Due to the increasingly massive amounts of data that need to be analyzed in digital forensic investigations, it is necessary to automatically recognize suspect files and filter out non-relevant files. To achieve this goal, digital forensic practitioners employ hashing algorithms to classify files into known-good, known-bad and unknown files. However, a typical personal computer may store hundreds of thousands of files and the task becomes extremely time-consuming. This paper attempts to address the problem using a framework that speeds up processing by using multiple threads. Unlike a typical multithreading approach, where the hashing algorithm is performed by multiple threads, the proposed framework incorporates a dedicated prefetcher thread that reads files from a device. Experimental results demonstrate a runtime efficiency of nearly 40% over single threading.},
Due to the increasingly massive amounts of data that need to be analyzed in digital forensic investigations, it is necessary to automatically recognize suspect files and filter out non-relevant files. To achieve this goal, digital forensic practitioners employ hashing algorithms to classify files into known-good, known-bad and unknown files. However, a typical personal computer may store hundreds of thousands of files and the task becomes extremely time-consuming. This paper attempts to address the problem using a framework that speeds up processing by using multiple threads. Unlike a typical multithreading approach, where the hashing algorithm is performed by multiple threads, the proposed framework incorporates a dedicated prefetcher thread that reads files from a device. Experimental results demonstrate a runtime efficiency of nearly 40% over single threading.
Performance Issues About Context-Triggered Piecewise Hashing Inproceedings
Gladyshev, Pavel; Rogers, MarcusK. (Ed.): Digital Forensics and Cyber Crime, pp. 141-155, Springer Berlin Heidelberg, 2012, ISBN: 978-3-642-35514-1.
@inproceedings{BB12a,
title = {Performance Issues About Context-Triggered Piecewise Hashing},
editor = {Pavel Gladyshev and MarcusK. Rogers},
abstract = {A hash function is a well-known method in computer science to map arbitrary large data to bit strings of a fixed short length. This property is used in computer forensics to identify known files on base of their hash value. As of today, in a pre-step process hash values of files are generated and stored in a database; typically a cryptographic hash function like MD5 or SHA-1 is used. Later the investigator computes hash values of files, which he finds on a storage medium, and performs look ups in his database. Due to security properties of cryptographic hash functions, they can not be used to identify similar files. Therefore Jesse Kornblum proposed a similarity preserving hash function to identify similar files. This paper discusses the efficiency of Kornblum's approach. We present some enhancements that increase the performance of his algorithm by 55% if applied to a real life scenario. Furthermore, we discuss some characteristics of a sample Windows XP system, which are relevant for the performance of Kornblum's approach.},
A hash function is a well-known method in computer science to map arbitrary large data to bit strings of a fixed short length. This property is used in computer forensics to identify known files on base of their hash value. As of today, in a pre-step process hash values of files are generated and stored in a database; typically a cryptographic hash function like MD5 or SHA-1 is used. Later the investigator computes hash values of files, which he finds on a storage medium, and performs look ups in his database. Due to security properties of cryptographic hash functions, they can not be used to identify similar files. Therefore Jesse Kornblum proposed a similarity preserving hash function to identify similar files. This paper discusses the efficiency of Kornblum's approach. We present some enhancements that increase the performance of his algorithm by 55% if applied to a real life scenario. Furthermore, we discuss some characteristics of a sample Windows XP system, which are relevant for the performance of Kornblum's approach.
Properties of a similarity preserving hash function and their realization in sdhash Inproceedings
Information Security for South Africa (ISSA), pp. 1-8, 2012.
title = {Properties of a similarity preserving hash function and their realization in sdhash},
url = {http://dx.doi.org/10.1109/ISSA.2012.6320445},
doi = {10.1109/ISSA.2012.6320445},
booktitle = {Information Security for South Africa (ISSA)},
abstract = {Finding similarities between byte sequences is a complex task and necessary in many areas of computer science, e.g., to identify malicious files or spam. Instead of comparing files against each other, one may apply a similarity preserving compression function (hash function) first and do the comparison for the hashes. Although we have different approaches, there is no clear definition / specification or needed properties of such algorithms available. This paper presents four basic properties for similarity pre- serving hash functions that are partly related to the properties of cryptographic hash functions. Compression and ease of computation are borrowed from traditional hash functions and define the hash value length and the performance. As every byte is expected to influence the hash value, we introduce coverage. Similarity score describes the need for a comparison function for hash values. We shortly discuss these properties with respect to three existing approaches and finally have a detailed view on the promising approach sdhash. However, we uncovered some bugs and other peculiarities of the implementation of sdhash. Finally we conclude that sdhash has the potential to be a robust similarity preserving digest algorithm, but there are some points that need to be improved.},
Finding similarities between byte sequences is a complex task and necessary in many areas of computer science, e.g., to identify malicious files or spam. Instead of comparing files against each other, one may apply a similarity preserving compression function (hash function) first and do the comparison for the hashes. Although we have different approaches, there is no clear definition / specification or needed properties of such algorithms available. This paper presents four basic properties for similarity pre- serving hash functions that are partly related to the properties of cryptographic hash functions. Compression and ease of computation are borrowed from traditional hash functions and define the hash value length and the performance. As every byte is expected to influence the hash value, we introduce coverage. Similarity score describes the need for a comparison function for hash values. We shortly discuss these properties with respect to three existing approaches and finally have a detailed view on the promising approach sdhash. However, we uncovered some bugs and other peculiarities of the implementation of sdhash. Finally we conclude that sdhash has the potential to be a robust similarity preserving digest algorithm, but there are some points that need to be improved.
http://dx.doi.org/10.1109/ISSA.2012.6320445
doi:10.1109/ISSA.2012.6320445
Breitinger, Frank; Baier, Harald; Beckingham, Jesse
Security and implementation analysis of the similarity digest sdhash Inproceedings
First International Baltic Conference on Network Security & Forensics (NeSeFo), 2012.
@inproceedings{BBB12,
title = {Security and implementation analysis of the similarity digest sdhash},
author = {Frank Breitinger and Harald Baier and Jesse Beckingham},
booktitle = {First International Baltic Conference on Network Security & Forensics (NeSeFo)},
A fuzzy hashing approach based on random sequences and hamming distance Inproceedings
Proceedings of the Conference on Digital Forensics, Security and Law, pp. 89–100, 2012.
@inproceedings{BB12b,
title = {A fuzzy hashing approach based on random sequences and hamming distance},
url = {https://commons.erau.edu/cgi/viewcontent.cgi?article=1193&context=adfsl},
abstract = {Hash functions are well-known methods in computer science to map arbitrary large input to bit strings of a fixed length that serve as unique input identifier/fingerprints. A key property of cryptographic hash functions is that even if only one bit of the input is changed the output behaves pseudo randomly and therefore similar files cannot be identified. However, in the area of computer forensics it is also necessary to find similar files (e.g. different versions of a file), wherefore we need a similarity preserving hash function also called fuzzy hash function. In this paper we present a new approach for fuzzy hashing called bbHash. It is based on the idea to `rebuild' an input as good as possible using a fixed set of randomly chosen byte sequences called building blocks of byte length l (e.g. l = 128). The proceeding is as follows: slide through the input byte-by-byte, read out the current input byte sequence of length l, and compute the Hamming distances of all building blocks against the current input byte sequence. Each building block with Hamming distance smaller than a certain threshold contributes the file's bbHash. We discuss (dis-)advantages of our bbHash to further fuzzy hash approaches. A key property of bbHash is that it is the first fuzzy hashing approach based on a comparison to external data structures.},
Hash functions are well-known methods in computer science to map arbitrary large input to bit strings of a fixed length that serve as unique input identifier/fingerprints. A key property of cryptographic hash functions is that even if only one bit of the input is changed the output behaves pseudo randomly and therefore similar files cannot be identified. However, in the area of computer forensics it is also necessary to find similar files (e.g. different versions of a file), wherefore we need a similarity preserving hash function also called fuzzy hash function. In this paper we present a new approach for fuzzy hashing called bbHash. It is based on the idea to `rebuild' an input as good as possible using a fixed set of randomly chosen byte sequences called building blocks of byte length l (e.g. l = 128). The proceeding is as follows: slide through the input byte-by-byte, read out the current input byte sequence of length l, and compute the Hamming distances of all building blocks against the current input byte sequence. Each building block with Hamming distance smaller than a certain threshold contributes the file's bbHash. We discuss (dis-)advantages of our bbHash to further fuzzy hash approaches. A key property of bbHash is that it is the first fuzzy hashing approach based on a comparison to external data structures.
https://commons.erau.edu/cgi/viewcontent.cgi?article=1193&context=adfsl
Baier, Harald; Breitinger, Frank
Security Aspects of Piecewise Hashing in Computer Forensics Inproceedings
IT Security Incident Management and IT Forensics (IMF), 2011 Sixth International Conference on, pp. 21-36, 2011.
@inproceedings{BB11,
title = {Security Aspects of Piecewise Hashing in Computer Forensics},
author = {Harald Baier and Frank Breitinger},
booktitle = {IT Security Incident Management and IT Forensics (IMF), 2011 Sixth International Conference on},
abstract = {Although hash functions are a well-known method in computer science to map arbitrary large data to bit strings of a fixed length, their use in computer forensics is currently very limited. As of today, in a pre-step process hash values of files are generated and stored in a database, typically a cryptographic hash function like MD5 or SHA-1 is used. Later the investigator computes hash values of files, which he finds on a storage medium, and performs look ups in his database. This approach has several drawbacks, which have been sketched in the community, and some alternative approaches have been proposed. The most popular one is due to Jesse Kornblum, who transferred ideas from spam detection to computer forensics in order to identify similar files. However, his proposal lacks a thorough security analysis. It is therefore one aim of the paper at hand to present some possible attack vectors of an active adversary to bypass Kornblum's approach. Furthermore, we present a pseudo random number generator being both more efficient and more random compared to Kornblum's pseudo random number generator.},
Although hash functions are a well-known method in computer science to map arbitrary large data to bit strings of a fixed length, their use in computer forensics is currently very limited. As of today, in a pre-step process hash values of files are generated and stored in a database, typically a cryptographic hash function like MD5 or SHA-1 is used. Later the investigator computes hash values of files, which he finds on a storage medium, and performs look ups in his database. This approach has several drawbacks, which have been sketched in the community, and some alternative approaches have been proposed. The most popular one is due to Jesse Kornblum, who transferred ideas from spam detection to computer forensics in order to identify similar files. However, his proposal lacks a thorough security analysis. It is therefore one aim of the paper at hand to present some possible attack vectors of an active adversary to bypass Kornblum's approach. Furthermore, we present a pseudo random number generator being both more efficient and more random compared to Kornblum's pseudo random number generator.
Breitinger, Frank; Nickel, Claudia
User Survey on Phone Security and Usage Inproceedings
Brömme, Arslan; Busch, Christoph (Ed.): BIOSIG, pp. 139-144, GI, 2010, ISBN: 978-3-88579-258-1.
@inproceedings{BN10,
title = {User Survey on Phone Security and Usage},
author = {Frank Breitinger and Claudia Nickel},
editor = {Arslan Brömme and Christoph Busch},
url = {http://dblp.uni-trier.de/db/conf/biosig/biosig2010.html#BreitingerN10},
booktitle = {BIOSIG},
publisher = {GI},
series = {LNI},
abstract = {Mobile phones are widely used nowadays and during the last years devel- oped from simple phones to small computers with an increasing number of features. These result in a wide variety of data stored on the devices which could be a high security risk in case of unauthorized access. A comprehensive user survey was con- ducted to get information about what data is really stored on the mobile devices, how it is currently protected and if biometric authentication methods could improve the cur- rent state. This paper states the results from about 550 users of mobile devices. The analysis revealed a very low securtiy level of the devices. This is partly due to a low security awareness of their owners and partly due to the low acceptance of the offered authentication method based on PIN. Further results like the experiences with mobile thefts and the willingness to use biometric authentication methods as alternative to PIN authentication are also stated.},
Mobile phones are widely used nowadays and during the last years devel- oped from simple phones to small computers with an increasing number of features. These result in a wide variety of data stored on the devices which could be a high security risk in case of unauthorized access. A comprehensive user survey was con- ducted to get information about what data is really stored on the mobile devices, how it is currently protected and if biometric authentication methods could improve the cur- rent state. This paper states the results from about 550 users of mobile devices. The analysis revealed a very low securtiy level of the devices. This is partly due to a low security awareness of their owners and partly due to the low acceptance of the offered authentication method based on PIN. Further results like the experiences with mobile thefts and the willingness to use biometric authentication methods as alternative to PIN authentication are also stated.
http://dblp.uni-trier.de/db/conf/biosig/biosig2010.html#BreitingerN10


text:
using LanguageExt.UnitsOfMeasure;
using Newtonsoft.Json;
using System;
using System.Collections.Generic;
using static LanguageExt.Prelude;
using static Echo.Process;
using LanguageExt;

namespace Echo
{
    /// <summary>
    /// Process that monitors the state of the cluster
    /// </summary>
    class ClusterMonitor
    {
        public const string MembersKey = "sys-cluster-members";
        static readonly Time HeartbeatFreq = 1*seconds;
        static readonly Time OfflineCutoff = 3*seconds;
        static readonly Time OfflineCutoff24 = 24*hours;

        public enum MsgTag
        {
            Heartbeat,
            ClusterMembersUpdated
        }

        public class Msg
        {
            public readonly MsgTag Tag;

            public Msg(MsgTag tag)
            {
                Tag = tag;
            }
        }

        public class State
        {
            public readonly HashMap<ProcessName, ClusterNode> Members;
            public readonly HashMap<ProcessName, ClusterNode> Members24;
            public readonly IActorSystem System;

            public static State Empty(IActorSystem system) => new State(
                HashMap<ProcessName, ClusterNode>(),
                HashMap<ProcessName, ClusterNode>(),
                system);

            public State(
                HashMap<ProcessName, ClusterNode> members,
                HashMap<ProcessName, ClusterNode> members24,
                IActorSystem system)
            {
                Members = members.Filter(node => node != null);
                Members24 = members24.Filter(node => node != null);
                System = system;
            }

            public State SetMember(ProcessName nodeName, ClusterNode state) =>
                state == null
                    ? RemoveMember(nodeName)
                    : new State(Members.AddOrUpdate(nodeName, state),
                                Members24.AddOrUpdate(nodeName, state),
                                System);

            public State RemoveMember(ProcessName nodeName) =>
                new State(Members.Remove(nodeName), Members24.Remove(nodeName), System);
        }

        /// <summary>
        /// Root Process setup
        /// </summary>
        public static State Setup(IActorSystem system) =>
            Heartbeat(State.Empty(system), system.Cluster);

        /// <summary>
        /// Root Process inbox
        /// </summary>
        public static State Inbox(State state, Msg msg)
        {
            switch (msg.Tag)
            {
                case MsgTag.Heartbeat:
                    try
                    {
                        return Heartbeat(state, state.System.Cluster);
                    }
                    catch(Exception e)
                    {
                        logErr(e);
                    }
                    finally
                    {
                        tellSelf(new Msg(MsgTag.Heartbeat), HeartbeatFreq + (random(1000) * milliseconds));
                    }
                    break;
            }

            return state;
        }

        /// <summary>
        /// If this node is part of a cluster then it updates a shared map of
        /// node-names to states.  This also downloads the latest map so the
        /// cluster state is known locally.
        /// </summary>
        /// <param name="state">Current state</param>
        /// <returns>Latest state from the cluster, or a map with just one item 'root'
        /// in it that represents this node.</returns>
        static State Heartbeat(State state, Option<ICluster> cluster) =>
            cluster.Map(
                c =>
                {
                    try
                    {
                        var cutOff = DateTime.UtcNow.Add(0 * seconds - OfflineCutoff);
                        var cutOff24 = DateTime.UtcNow.Add(0 * seconds - OfflineCutoff24);

                        c.HashFieldAddOrUpdate(MembersKey, c.NodeName.Value, new ClusterNode(c.NodeName, DateTime.UtcNow, c.Role));
                        var s = c.GetHashFields<ProcessName, ClusterNode>(MembersKey, s => new ProcessName(s));
                        var newState = new State(
                            members: s.Where(m => m.LastHeartbeat > cutOff),
                            members24: s.Where(m => m.LastHeartbeat > cutOff24),
                            system: state.System);
                        var diffs = DiffState(state, newState);

                        diffs.Item1.Iter(offline => publish(state.Members[offline]));
                        diffs.Item2.Iter(online  => publish(newState.Members[online]));

                        return newState;
                    }
                    catch(Exception e)
                    {
                        logErr(e);
                        return HeartbeatLocal(state);
                    }
                })
            .IfNone(HeartbeatLocal(state));

        static Tuple<Set<ProcessName>, Set<ProcessName>> DiffState(State oldState, State newState)
        {
            var oldSet = toSet(oldState.Members.Keys);
            var newSet = toSet(newState.Members.Keys);
            return Tuple(oldSet - newSet, newSet - oldSet);
        }

        static State HeartbeatLocal(State state) =>
            state.SetMember("root", new ClusterNode("root", DateTime.UtcNow, "local"));

        static string GetNodeName(Option<ICluster> cluster) =>
            cluster.Map(c => c.NodeName.Value).IfNone("root");
    }
}

redpajama_set_name: RedPajamaGithub


text:
Het Colombiaans honkbalteam is het nationale honkbalteam van Colombia. Het team vertegenwoordigt Colombia tijdens internationale wedstrijden.

Het Colombiaans honkbalteam hoort bij de Pan-Amerikaanse Honkbal Confederatie (COPABE).

Wereldkampioenschappen
Colombia nam 19x keer (op 39 edities) deel aan de wereldkampioenschappen honkbal. Colombia werd twee keer wereldkampioen, in 1947 en in 1965. Beide keren was Colombia gastheer van het kampioenschap. Colombia vervulde deze rol ook nog in 1970 en 1976. Naast de twee wereldtitels werd nog 2x de zilveren en bronzen medaille gewonnen.

 *  WK in Cuba

World Baseball Classic
Colombia nam in 2012 deel aan de kwalificatie voor de World Baseball Classic in 2013.

Nationaal honkbalteam
Honkbal

redpajama_set_name: RedPajamaWikipedia


text:
Bouncing Boeing
BusinessJun 13th 1998 edition
HAS Boeing hired the Grand Old Duke of York to run its factories? In the autumn it could not cope with a bulging order book and halted production lines for a month to complete a number of aircraft that were missing parts. By Christmas, the situation had not much changed: Ron Woodard, the boss of Boeing Commercial Airplane Group, said cancellations by stricken Asian airlines would be a welcome relief to his overloaded factories—though he did not in fact expect any. By May, it was a different story. Mr Woodard was admitting that the Asian crisis would cause a cut of 20% in the production of jumbo jets. This week 20% became 30%.
Asia is a big market for jumbos and more than 20 orders have been postponed, if not exactly cancelled. Impoverished airlines in the region are also putting existing jumbos up for sale, which weakens the worldwide market for new aircraft. Boeing's 747 production line, scheduled to speed up to five aircraft a month from four this quarter, will now slow to 3.5 next spring. Similarly, Boeing's other wide-body, the 777, which is accelerating from five a month to seven this summer, will throttle back to five by the end of next year. As this happens, 12,000 of Boeing's non-defence employees—about 10% of the total—will go, one insider says.
To make life more complicated for Mr Woodard, the worst may be yet to come for the overloaded lines making narrow-bodied 737 aircraft. This week his salesmen landed a $2 billion order from Korean Air for 27 of Boeing's 737s, which, with the stimulus to short-haul routes in the region from deregulation, is the one type of airliner in demand in Asia. Production of 737s will continue to rise from today's 24 a month to 27 next year.
In other words, Boeing had failed to manage the boom, and is now being overtaken by the first hint of a bust. There is worse. Amid the $4 billion in provisions Boeing has announced in the past six months (to cover reorganisation after the McDonnell Douglas merger, penalties for late deliveries and so on), $1 billion is to cover losses the company will make on the sale of the first 400 of its new-model 737s. It has rebuilt some of these because they had too few emergency exits to satisfy European safety standards. (Boeing had thought the new model would qualify as an upgrade rather than a completely new aircraft requiring fresh safety certification. Some Boeing people suspect an Airbus-inspired conspiracy.)
But the company made a more fundamental miscalculation with this latest version of the world's best-selling aircaft. It decided to compete against the rival Airbus narrow-bodies (the A320 family) largely on price, rather than on technical and operational factors. The price war which this unleashed still goes on. Boeing made a net loss of $178m in 1997 and the Airbus consortium's net profit fell 61% to DM267.9m ($154m).
To cap it all, in choosing this strategy, Boeing wrongly assumed it could cut costs by 25% between 1994 and 1998. It failed to meet that target, even before production delays meant that extra overtime was needed and costs went through the roof. The way things are going, Airbus will take half of the world market this year. If this is what happens to Boeing in the third year of a jetplane boom, what on earth will happen in the downturn?
This article appeared in the Business section of the print edition under the headline "Bouncing Boeing"
Bearing fruit
After years of dithering companies are embracing automation
Visa-free travel
American trustbusters force Visa to back off Plaid
Steel and silicon
CES upstages the Detroit Motor Show as cars go electronic

redpajama_set_name: RedPajamaCommonCrawl


text:
using System;

namespace OpenSage.Gui.Apt.ActionScript.Opcodes
{
    /// <summary>
    /// Start playback of the current object (must be sprite)
    /// </summary>
    public sealed class Play : InstructionBase
    {
        public override InstructionType Type => InstructionType.Play;

        public override void Execute(ActionContext context)
        {
            if (context.Scope.Item is SpriteItem si)
            {
                si.Play();
            }
            else
            {
                throw new InvalidOperationException();
            }
        }
    }

    /// <summary>
    /// Stop playback of the current object (must be sprite)
    /// </summary>
    public sealed class Stop : InstructionBase
    {
        public override InstructionType Type => InstructionType.Stop;

        public override void Execute(ActionContext context)
        {
            if (context.Scope.Item is SpriteItem si)
            {
                si.Stop();
            }
            else
            {
                throw new InvalidOperationException();
            }
        }
    }

    /// <summary>
    /// Jump to a specific frame number (must be sprite)
    /// </summary>
    public sealed class GotoFrame : InstructionBase
    {
        public override InstructionType Type => InstructionType.GotoFrame;
        public override uint Size => 4;

        public override void Execute(ActionContext context)
        {
            var frame = Parameters[0].ToInteger();
            if (context.Scope.Item is SpriteItem si)
            {
                si.GotoFrame(frame);
            }
            else
            {
                throw new InvalidOperationException();
            }
        }
    }

    /// <summary>
    /// Jump to a specific frame (label or number) and start playing or stop
    /// </summary>
    public sealed class GotoFrame2 : InstructionBase
    {
        public override InstructionType Type => InstructionType.GotoFrame2;
        public override uint Size => 4;

        public override void Execute(ActionContext context)
        {
            bool play = Convert.ToBoolean(Parameters[0].ToInteger() & 0x01);
            var frame = context.Pop();

            if (context.Scope.Item is SpriteItem si)
            {
                if (frame.Type == ValueType.String)
                {
                    si.Goto(frame.ToString());
                }
                else
                {
                    si.GotoFrame(frame.ToInteger());
                }

                if (play)
                {
                    si.Play();
                }
                else
                {
                    si.Stop();
                }
            }
            else
            {
                throw new InvalidOperationException();
            }
        }
    }

    /// <summary>
    /// Jump to a labeled frame (must be sprite)
    /// </summary>
    public sealed class GotoLabel : InstructionBase
    {
        public override InstructionType Type => InstructionType.GotoLabel;
        public override uint Size => 4;

        public override void Execute(ActionContext context)
        {
            var label = Parameters[0].ToString();

            if (context.Scope.Item is SpriteItem si)
                si.Goto(label);
            else
                throw new InvalidOperationException();
        }
    }

    /// <summary>
    /// NextFrame
    /// </summary>
    public sealed class NextFrame : InstructionBase
    {
        public override InstructionType Type => InstructionType.NextFrame;

        public override void Execute(ActionContext context)
        {
            if (context.Scope.Item is SpriteItem si)
            {
                si.NextFrame();
            }
            else
            {
                throw new InvalidOperationException();
            }
        }
    }
}


text:
The Eclectic Review
So many genres, so little time
Review Directory by Author
The Night Thief (Devil's Lair #3) by Beena Khan
Book Review, Dark, Mafia, Romance, Series
February 11, 2022 February 11, 2022 by Sharon Clayton
One last heist. One last gamble.
I'm a woman on the run. A con artist, scamming my way into the rich for my livelihood and my Boss, Ghaffar's. I set my eyes on one of the most popular casinos in the city.
The Moretti Casino.
The problem is that the owners are two notorious mafia members of one of the most dangerous Families of New York. I slip in, posing as a mafia princess, but then a pair of piercing blue eyes catches me red-handed. The tables have turned… I'm no princess, I'm a thief and he's the mafia prince.
Romeo Moretti.
I'm given two choices: die or do his bidding.
He has a plan for me. Three wishes he wants from me. And the last wish is… he wants me to rob a rival. I just hope I don't gamble my heart away to him in the process.
Welcome to New York's Underworld.
Loosely based on the fairytale Aladdin.
I have devoured Beena Khan's books since her debut novel The Name of Red. Her extremely messed up and addictive characters surviving in their sick and twisted volatile worlds is nothing short of spectacular. Roman and Ayla's story is no exception as two criminals come face to face with their own undoing.
I couldn't wait for Romeo's story after the whole fucked up mess he got himself into with his brother Don Salvi Moretti and the broken and betrayed Ehva Rossi (see The Blue-eyed Devil and The Fallen Angel). Romeo is the total opposite of the smiling and dapper Don, choosing to be broody and unkempt instead. Then along comes a little thief who not only wants his money, but his dead heart too.
Alya Lord lives in a cage. Since the age of 10, a stranger called Ghaffar "G" found her and raised her to be a criminal. G's successful bank heists are talked about around the world. But his crazy decision to steal from a casino owned by the Moretti brothers is a death wish and G's little thief is about to learn who the real criminals are.
My heart broke for Alya as she realizes everything she knows is a lie and G is not the man she thought she knew. She hates robbing people and only wants to get out of the business and move on with her life. Alya is a strong sassy thing with her brutally honest impertinence to the Don's Second in Command who wouldn't hesitate to kill her, but he doesn't. Instead, Romeo shows her a part of himself he's never shown anyone, and then she betrays him. A feeling not unknown to him. The verbal sparring and the hot sex scenes between Romeo and Alya are exciting and satisfying. It's rewarding to watch Romeo slowly realize Alya's situation and sets her free giving her a choice (something she never had with G) to control her own life and decide whether to stay or not. It's a very brave thing on Romeo's part because he wants to protect her and to keep her forever. I also enjoy the way Alya openly expresses her feelings for him as he battles with his own feelings for her. A Princess and a Prince. A thief and a killer. A criminal and a criminal. A love that knows no bounds.
I love Romeo's sweet side with his niece Ranya. His relationship with his brother is affectionate and teasing and his relationship with his sister-in-law Ehva is strained and I like how the author slowly tries to mend those fences. The mysterious G is an enigma with his nightmares and his murderous rages which are never directed at Alya. With her, he is selfish and controlling. Does he truly love her?
Finding Alya's family was something that wasn't addressed and I hope Ms. Khan adds that update to her next novel as an epilogue. A lovely addition she adds to her novels.
Dark romance is one of my favorite genres and Beena Khan writes the hell out of them. Her characters are mysterious and unpredictable and her plots are full of twists and turns. This book can be read as a standalone, but to get the true feel of the Moretti's pick up the series. You won't regret it.
Thank you once again to Ms. Khan for giving me the opportunity to read this book with no expectation of a positive review.
Beena Khan is a storyteller in her twenties residing in NYC where she brings dark fairytales and myths to life. She writes edgy mafia crime noir, romance thrillers, new adult, women's fiction, and contemporary fiction that gives you a book hangover. Her books are painful, messy, dangerous, and raw. She has a Master's Degree in Psychology and a minor in Arabic studies.
Her women's fiction and contemporary books is where you will find flawed gentlemen. Her darker books is where you will find morally gray anti-heroes and villains.
Subscribe to her newsletter for exclusive content, upcoming releases, cover reveals, ARCS, excerpts, teasers, giveaways, and book trailers!
Follower Beena at Instagram, Twitter, Facebook, Facebook Group, and Bookbub.
Ethan (Family Ties #1) by Delaney Diamond
Ten Rules for Marrying a Duke by Michelle McLean
Top Posts in Last 2 Days
Does It Hurt? by H.D. Carlton
The Ex I'd Love To Hate (The Lasker Brothers #3) by Nadia Lee
Twisted Love (Twisted #1) by Ana Huang
The Bully (Kingmakers #3) by Sophie Lark
Choosing Theo (Clecanian #1) by Victoria Aveline
Darling Venom by Parker S. Huntington
Suffer in Silence (The Malvagio Mafia #1) by Kelsey Clayton
At Last (Seven Brides for Seven Mothers #8) by Whitney Dineen
Screams in Symphony (The Malvagio Mafia #2) by Kelsey Clayton
Anastasia by Sophie Lark
Literary Quicksand
Bestsellers World
Slaves of Golconda
Stop, You're Killing Me!
Anz Litlovers Litblog
RA for All
Blogging for a Good Book
Armchair Interviews
Erin Shelby
Bookreporter.com
The Big Thrill
Cheryl's Book Nook
Flora's Musings
Archives Select Month February 2023 January 2023 December 2022 November 2022 October 2022 September 2022 August 2022 July 2022 June 2022 May 2022 April 2022 March 2022 February 2022 January 2022 December 2021 November 2021 October 2021 September 2021 August 2021 July 2021 June 2021 May 2021 April 2021 March 2021 February 2021 January 2021 December 2020 November 2020 October 2020 September 2020 August 2020 July 2020 June 2020 May 2020 April 2020 March 2020 February 2020 January 2020 December 2019 November 2019 October 2019 September 2019 August 2019 July 2019 June 2019 May 2019 April 2019 March 2019 February 2019 January 2019 December 2018 November 2018 October 2018 September 2018 August 2018 July 2018 June 2018 May 2018 April 2018 March 2018 February 2018 January 2018 December 2017 November 2017 October 2017 September 2017 August 2017 July 2017 December 2016 August 2016 July 2016 March 2016 January 2016 July 2015 May 2015 July 2013 June 2013 April 2013 March 2013 February 2013 January 2013 December 2012 November 2012 October 2012 September 2012 August 2012 July 2012 June 2012 May 2012 April 2012 March 2012 February 2012 January 2012 December 2011 November 2011 October 2011 September 2011 August 2011 July 2011 June 2011 April 2011 March 2011 February 2011 November 2010 September 2010 August 2010 July 2010 June 2010 May 2010 April 2010 March 2010 February 2010 January 2010 December 2009 November 2009 July 2009 June 2009 May 2009 April 2009 March 2009 February 2009
© The Eclectic Review, 2023. Unauthorized use and/or duplication of this material without express and written permission from this site's author and/or owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to The Eclectic Review with appropriate and specific direction to the original content.


Take a look at these 27 DIY Christmas decoration ideas. They are cheap, easy and fun and following them can make your festive season special!
We're sure you'll love these Christmas decoration, these DIY ideas are out the box, best, and easy to follow.
We've already posted a lot of DIY ideas using old tires, now here's one more idea for you. Just grab some old tires and clean them with a brush and cleaner. Cut a plywood to the size of tire for the front of ornament and staple the ply to tire with a staple gun. Now spray paint your tires and use a stencil to complete the look.
You'll love them, and your neighbors will love them. A unique and catchy Christmas decor DIY idea you can follow. It is much easier than it seems and only requires the chicken wire, small wire cutters, a measuring tape, gloves, and LED lights. You can place it on your patio, garden or even on trees.


People living in social housing are 20% less likely to have the digital skills they need than people who rent privately.
SCVO are kicking off a new project, with opportunities for housing organisations across Scotland to help change this statistic by becoming part of a social housing digital champion network.
SCVO believe one of the most effective ways of helping people to improve their digital skills is through regular support from someone trusted – a digital champion.
The project will offer comprehensive training and support, fully funded for up to 30 housing organisations.
access to credit rated qualifications for involved staff to aid career progress.
If you are interested in finding out more or registering an interest get in touch with @digiscot or email digital@scvo.org.uk, or give Beth a ring on 07581 623 028.


I am not becoming patriotic but economic; It is not a waste to write on paper but I thought I was going to leave a blank page. It has not been hot at all here for two days; we have had a lot of rain. Dear Emmie I thank you for the stamps I found them as you said. I did not think of them until I had stuck the envelope down. I am sorry to hear Mr Zunfus is wounded; I hope it is not serious. I hope you will not have 4 days work on hand when I come home. I hope to get my four days from 7 July; how would you like that? It will be on a Saturday so you will not be absent from work so long as if it was the week. I would like you to make half the programme out as to how I am to spend the time. (If I get it) This date is not official. What do you think of the rebellion in Austria; I hope it helps to bring the end of this conflict nearer. I am glad I am not getting my time to see the Bazzar because I want you all to myself while I have the chance. One of the boys in my room said that he would not mind waiting for a month for his leave because if he had it first he would not feel satisfied at seeing all the others go home. As it happens he is one of the first but of course he does not mind. Kings X road is rather near I hope they get no nearer (zepps). How is your Father going on for potatoes. Has Leslie got a new job? I know I will hear from you first that is why I ask you.
P.S. I did not notice it but I meant to write this on a piece of 100 T.R.B. paper. I will next time as you seem to like it.


It's been a pleasure to collect your wishes for Haiti, on the occasion of her bicentennial. Let's work to make those wishes come true.
Messages are listed below by region. See them in chronological order.
United States - Dr. Serge A. Bonhomme, Sr.
United States - Emmanuel I.
United States - Gerard Dantel, Jr.
United States - Jocelaine J.
United States - Joseph Biamby Jr.


Insurance company awards $5,000 in scholarships as part of its distracted driving awareness program.
United Fire Group, Inc. (UFG) recently announced the five students selected to receive a $1,000 scholarship as part of its Worth It distracted driving awareness program. The winners were selected based on their original essay explaining why they believe life is worth it, and distracted driving is not.
The scholarship program is in its first year and was created when the Worth It program was introduced in October 2017. It is open to any high school senior or graduate who plans to enroll or current undergraduate student who is already enrolled in full-time undergraduate study at an accredited two-year or four-year college, university or vocational-technical school for the entire academic year.
Mike Sheeley, UFG vice president, corporate marketing, says the company received more than 160 submissions from students across the country.
Submissions for the 2019-2020 school year will be accepted beginning October 1, 2018, via the Worth It website scholarship page.
About United Fire Group, Inc.
Founded in 1946 as United Fire & Casualty Company, UFG (Nasdaq: UFCS) is engaged in the business of writing property and casualty insurance through its insurance company subsidiaries. Headquartered in Cedar Rapids, Iowa, UFG is licensed as a property and casualty insurer in 46 states, plus the District of Columbia, and is represented by approximately 1,150 independent agencies. A.M. Best Company assigns a rating of "A" (Excellent) for the members of United Fire & Casualty Group. In addition to its Cedar Rapids office, UFG also operates regional offices in Arizona, California, Colorado, New Jersey and Texas. For more information, visit http://www.ufginsurance.com.


text:
Avon ist eine Stadt im Hendricks County im Bundesstaat Indiana in den USA.

Bevölkerung

Die Stadt hatte im Jahre 2020 laut Volkszählung des US Census Bureau 21.474 Einwohner, verteilt auf 5.636 Haushalte. 83,8 % der Bevölkerung sind Weiße, 6,6 % Latinos, 9,1 % Afroamerikaner, 0,5 % Indianer, die restliche Bevölkerung gehörte anderen Rassen an.

Söhne und Töchter der Stadt
 Mike Larrison (* 1981), Autorennfahrer
 William Temple Hornaday (1854–1937), Taxidermist und Zoodirektor

Persönlichkeiten mit Wohnsitz in Avon
 Steve Talley (* 1981), Schauspieler

Einzelnachweise

Ort in Indiana


Most dash cams I've tested on TechWalls are budget options which cost less than $100. The KDLinks X1 is the most expensive one and also the highest-rated dash cam on Amazon. Therefore, I was really excited to give it a try. Is it worth the extra money? We're going to find out in the review.
The KDLinks X1 is an expensive dash cam but the build quality is not necessarily better than cheaper options. The whole product is still made of plastic and feels cheaper than its premium price tag.
On the other hand, the dashcam looks good in a slim design and it's packed with a lot of features. It comes with a large 2.7-inch display, a GPS module, a f/1.6 six-glass lens, an 110mAh battery, and an 8GB microSD card.
This is my first dashcam with GPS feature and it could be very helpful in some cases. After installing the KDLINKS Dashcam Player Software, you can track your vehicle's location, speed, and route when viewing your footages.
In terms of video quality, the dashcam is better than all other products I've used. The image is smooth and doesn't look grainy at all. Even when recording at night, it still can deliver an accurate color and well-exposed image. Check out some video samples below.
The KDLinks X1 is a lot more expensive than most dashboard cameras on the market. Its best features are the GPS module and a high-quality lens, so you should consider carefully if you really need them.
A high-quality dash cam with some premium features.