{"id":"https://openalex.org/W2595520018","doi":"https://doi.org/10.1515/itit-2016-0036","title":"On the misuse of graphical user interface elements to implement security controls","display_name":"On the misuse of graphical user interface elements to implement security controls","publication_year":2017,"publication_date":"2017-03-15","ids":{"openalex":"https://openalex.org/W2595520018","doi":"https://doi.org/10.1515/itit-2016-0036","mag":"2595520018"},"language":"en","primary_location":{"id":"doi:10.1515/itit-2016-0036","is_oa":false,"landing_page_url":"https://doi.org/10.1515/itit-2016-0036","pdf_url":null,"source":{"id":"https://openalex.org/S4210229153","display_name":"it - Information Technology","issn_l":"1611-2776","issn":["1611-2776","2196-7032"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319967","host_organization_name":"R. Oldenbourg Verlag","host_organization_lineage":["https://openalex.org/P4310319967"],"host_organization_lineage_names":["R. Oldenbourg Verlag"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"it - Information Technology","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5090070759","display_name":"Collin Mulliner","orcid":null},"institutions":[{"id":"https://openalex.org/I12912129","display_name":"Northeastern University","ror":"https://ror.org/04t5xt781","country_code":"US","type":"education","lineage":["https://openalex.org/I12912129"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Collin Mulliner","raw_affiliation_strings":["Secure Systems Lab, Northeastern University, 360 Huntington Ave, Boston, MA, 02115 United States of America"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Secure Systems Lab, Northeastern University, 360 Huntington Ave, Boston, MA, 02115 United States of America","institution_ids":["https://openalex.org/I12912129"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5085358980","display_name":"William Robertson","orcid":"https://orcid.org/0000-0002-6968-0273"},"institutions":[{"id":"https://openalex.org/I12912129","display_name":"Northeastern University","ror":"https://ror.org/04t5xt781","country_code":"US","type":"education","lineage":["https://openalex.org/I12912129"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"William Robertson","raw_affiliation_strings":["Secure Systems Lab, Northeastern University, 360 Huntington Ave, Boston, MA, 02115 United States of America"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Secure Systems Lab, Northeastern University, 360 Huntington Ave, Boston, MA, 02115 United States of America","institution_ids":["https://openalex.org/I12912129"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5077875821","display_name":"Engin Kirda","orcid":"https://orcid.org/0000-0001-9988-6873"},"institutions":[{"id":"https://openalex.org/I12912129","display_name":"Northeastern University","ror":"https://ror.org/04t5xt781","country_code":"US","type":"education","lineage":["https://openalex.org/I12912129"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Engin Kirda","raw_affiliation_strings":["Secure Systems Lab, Northeastern University, 360 Huntington Ave, Boston, MA, 02115 United States of America"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Secure Systems Lab, Northeastern University, 360 Huntington Ave, Boston, MA, 02115 United States of America","institution_ids":["https://openalex.org/I12912129"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5090070759"],"corresponding_institution_ids":["https://openalex.org/I12912129"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.01624638,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"59","issue":"2","first_page":"59","last_page":"65"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9983999729156494,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9983999729156494,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9975000023841858,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9569000005722046,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/graphical-user-interface","display_name":"Graphical user interface","score":0.8119382858276367},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.80771803855896},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.5809899568557739},{"id":"https://openalex.org/keywords/access-control","display_name":"Access control","score":0.5660237073898315},{"id":"https://openalex.org/keywords/human\u2013computer-interaction","display_name":"Human\u2013computer interaction","score":0.5490539073944092},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.48077815771102905},{"id":"https://openalex.org/keywords/interface","display_name":"Interface (matter)","score":0.47749966382980347},{"id":"https://openalex.org/keywords/user-interface","display_name":"User interface","score":0.4739009439945221},{"id":"https://openalex.org/keywords/visibility","display_name":"Visibility","score":0.4704427123069763},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4618507921695709},{"id":"https://openalex.org/keywords/privilege","display_name":"Privilege (computing)","score":0.4544444978237152},{"id":"https://openalex.org/keywords/class","display_name":"Class (philosophy)","score":0.4331074059009552},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.3437742590904236},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.18335184454917908},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.12441554665565491},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.11680084466934204}],"concepts":[{"id":"https://openalex.org/C37789001","wikidata":"https://www.wikidata.org/wiki/Q782543","display_name":"Graphical user interface","level":2,"score":0.8119382858276367},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.80771803855896},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5809899568557739},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.5660237073898315},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.5490539073944092},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.48077815771102905},{"id":"https://openalex.org/C113843644","wikidata":"https://www.wikidata.org/wiki/Q901882","display_name":"Interface (matter)","level":4,"score":0.47749966382980347},{"id":"https://openalex.org/C89505385","wikidata":"https://www.wikidata.org/wiki/Q47146","display_name":"User interface","level":2,"score":0.4739009439945221},{"id":"https://openalex.org/C123403432","wikidata":"https://www.wikidata.org/wiki/Q654068","display_name":"Visibility","level":2,"score":0.4704427123069763},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4618507921695709},{"id":"https://openalex.org/C2780138299","wikidata":"https://www.wikidata.org/wiki/Q3404265","display_name":"Privilege (computing)","level":2,"score":0.4544444978237152},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.4331074059009552},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.3437742590904236},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.18335184454917908},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.12441554665565491},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.11680084466934204},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C157915830","wikidata":"https://www.wikidata.org/wiki/Q2928001","display_name":"Bubble","level":2,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C129307140","wikidata":"https://www.wikidata.org/wiki/Q6795880","display_name":"Maximum bubble pressure method","level":3,"score":0.0},{"id":"https://openalex.org/C120665830","wikidata":"https://www.wikidata.org/wiki/Q14620","display_name":"Optics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1515/itit-2016-0036","is_oa":false,"landing_page_url":"https://doi.org/10.1515/itit-2016-0036","pdf_url":null,"source":{"id":"https://openalex.org/S4210229153","display_name":"it - Information Technology","issn_l":"1611-2776","issn":["1611-2776","2196-7032"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319967","host_organization_name":"R. Oldenbourg Verlag","host_organization_lineage":["https://openalex.org/P4310319967"],"host_organization_lineage_names":["R. Oldenbourg Verlag"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"it - Information Technology","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.7400000095367432,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W3180179400","https://openalex.org/W2118366689","https://openalex.org/W2154998455","https://openalex.org/W2116888309","https://openalex.org/W2477652530","https://openalex.org/W2039055059","https://openalex.org/W2381088774","https://openalex.org/W963721989","https://openalex.org/W2183494409","https://openalex.org/W3121870801"],"abstract_inverted_index":{"Abstract":[0],"GUIs":[1,13,29],"are":[2,49],"the":[3,32,79,90,151,162,165],"predominant":[4],"means":[5],"by":[6],"which":[7],"users":[8,57],"interact":[9],"with":[10],"modern":[11],"programs.":[12],"contain":[14],"a":[15,99,109],"number":[16],"of":[17,81,114,140,150,174],"common":[18],"visual":[19,54],"elements":[20,117],"widgets":[21,39],"such":[22],"as":[23,98,169],"buttons,":[24],"textfields,":[25],"and":[26,28,44,133,156],"lists,":[27],"typically":[30],"provide":[31,53],"ability":[33],"to":[34,40,52,56,58,111,118,168],"change":[35],"attributes":[36,48,94],"on":[37,125,154],"these":[38,47],"control":[41,104],"their":[42],"visibility":[43],"behavior.":[45],"While":[46],"extremely":[50],"useful":[51],"cues":[55],"guide":[59],"them":[60],"through":[61],"an":[62],"application's":[63],"GUI,":[64],"they":[65,72],"can":[66],"also":[67],"be":[68,96],"misused":[69,97],"for":[70,101],"purposes":[71],"were":[73],"not":[74],"intended.":[75],"In":[76],"particular,":[77],"in":[78,144,148,188],"context":[80],"GUI-based":[82],"applications":[83],"that":[84,160],"include":[85],"multiple":[86],"privilege":[87],"levels":[88],"within":[89],"application,":[91],"GUI":[92,175],"element":[93,176],"may":[95],"mechanism":[100],"enforcing":[102],"access":[103,120],"policies.":[105],"This":[106],"work":[107,128],"presents":[108],"method":[110,183],"detect":[112],"misuse":[113,177],"user":[115],"interface":[116],"implement":[119],"control,":[121],"it":[122],"is":[123],"based":[124],"our":[126,180],"earlier":[127],"C.":[129],"Mulliner,":[130],"W.":[131],"Robertson,":[132],"E.":[134],"Kirda,":[135],"\u201cHidden":[136],"GEMs:":[137],"Automated":[138],"Discovery":[139],"Access":[141],"Control":[142],"Vulnerabilities":[143],"Graphical":[145],"User":[146],"Interfaces\u201d,":[147],"Proceedings":[149],"IEEE":[152],"Symposium":[153],"Security":[155],"Privacy":[157],",":[158,171],"2014.":[159],"introduced":[161],"vulnerability":[163],"class":[164],"we":[166,184],"refer":[167],"GEMs":[170],"or":[172],"instances":[173],".":[178],"Using":[179],"GEM":[181],"detection":[182],"discovered":[185],"unknown":[186],"vulnerabilities":[187],"several":[189],"applications.":[190]},"counts_by_year":[],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2025-10-10T00:00:00"}