Acta Informatica Pragensia

226-241

Authors: Jana Šťastná, Ján Juhár, Miroslav Biňas, Martin Tomášek

A desirable characteristic of programming code assessment is to provide the learner the most appropriate information regarding the code functionality as well as a chance to improve. This can be hardly achieved in case the number of learners is high (500 or more). In this paper we address the problem of risky code testing and availability of an assessment platform Arena, dealing with potential security risks when providing an automated assessment for a large set of source code. Looking at students’ programs as if they were potentially malicious inspired us to investigate separated execution environments, used by security experts for secure software analysis. The results also show that availability issues of our assessment platform can be conveniently resolved with task queues. A special attention is paid to Docker, a virtual container ensuring no risky code can affect the assessment system security. The assessment platform Arena enables to regularly, effectively and securely assess students' source code in various programming courses. In addition to that it is a motivating factor and helps students to engage in the educational process.

258-275

Authors: Branislav Madoš, Mária Feková

Ambition to achieve possibility to hide digitally represented information which is coded in bit sequences into digital cover media is fulfilled through a number of steganographic algorithms, including Least Significant Bit (LSB) algorithm. A further development of those algorithms can be seen in the use of multiple cover media in the form of their sets, into which digital information is distributed by the use of multiple distribution functions (multi-carrier steganographic algorithms). This paper describes design of steganographic algorithm that is based on the use of the Least Significant Bit (LSB) and three distribution functions, which allow to distribute digital information into the set of cover media. The part of this article is describing software solution which was designed, developed and tested as the part of this research.

288-301

Authors: Ján Hurtuk

Nowadays, in today’s society based on a wide range of the technical and computing devices, it opens wide scope for misusing vulnerabilities of managing software, for destructive or enriching purposes. Daily are developed and deployed increasingly sophisticated malicious software, enabling the controlling of contested system or misusing sensitive information that infected system stores. One of the yet unexplored areas represent non-standard forms of communication used by such software, without access to network services, which could in the future represent a real threat to certain conditions. This article describes the design and subsequent implementation of a special type of malicious software that communications components are based on IRC (Internet Relay Chat) and in case of unavailability of the network connection takes into account the possibility of communicating infected computer systems by generating sound waves. It examines the various branches of behavior, based on ongoing conditions, its weaknesses, and finally points out the most important indicators of the effectiveness of its activities. The second part of the article is devoted to experimental methods of communication using sound waves with frequencies outside the audible range. The last part of the article presents the results of a questionnaire, which clearly point to the widespread use of equipment needed to run the branches of the virus, which is closely associated with the generation of signals with the help of sound waves, and thus point to the threat of the possible use of similarly based viruses in real operation. In conclusion, it is pointed out to the fact that a similar type of malware is fully usable under certain conditions, and it can be fully deployed in real environment.

310-317

Authors: Anton Baláž, Branislav Madoš, Michal Ambróz

The main objective of this work is to analyze and extend security model of mobile devices running on Android OS. Provided security extension is a Linux kernel security module that allows the system administrator to restrict program's capabilities with per-program profiles. Profiles can allow capabilities like network access, raw socket access, and the permission to read, write, or execute files on matching paths. Module supplements the traditional Android capability access control model by providing mandatory access control (MAC) based on path. This extension increases security of access to system objects in a device and allows creating security sandboxes per application.

326-335

Authors: Milan Kný

The aim of the contribution is the use of the systems approach to treat security management as a practical field and new scientific discipline. The philosophy of systems approach to the solution of problems generally is an adequate methodological basis even for the theory of management. The path to the real optimization of security situation leads only through the holistic and solid solution. Applications of systems analysis and synthesis back up the fact, that systems approach and systems thinking should not absent in security objects. The truthfulness of the claim, that security management is a well-established discipline, depends on ongoing discussion that represents useful process of development of new scientific discipline. At the same time the rationality of science and systematism works as a counterbalance to irrational fear of the whole society, too. Which questions of security remain open in relation to „our interests“? Current problems of Europe should be solved systematically. It is necessary to define the space of interest (territorially the border of the EU or the Schengen area), to implement the system to the object with respect to the borders of the space, to specify the structure and subjects of decision making and implementation.