Path Oblivious Heap - Optimal and Practical Oblivious Priority Queue
Explore an innovative, efficient oblivious priority queue algorithm with optimal performance and practical applications in secure data structures and sorting.
TextExerciser - Feedback-Driven Text Input Exercising for Android Applications
Iterative, feedback-driven system for generating text inputs in Android app testing. Utilizes app-provided hints to improve input generation, increasing code coverage and vulnerability detection.
TARDIS - Rolling Back the Clock on CMS-Targeting Cyber Attacks
Automated system for detecting and remediating long-lived multi-stage attacks on CMS-based websites using nightly backups, improving security beyond traditional "backup and restore" models.
Understanding the Prevailing Security Vulnerabilities in TrustZone-Assisted TEE Systems
Comprehensive analysis of security vulnerabilities in TrustZone-assisted Trusted Execution Environments, exploring architecture issues, implementation bugs, and hardware flaws across popular TEE systems. Offers insights for improving TEE security.
Influencing Photo Sharing Decisions on Social Media - A Case of Paradoxical Findings
Explore how perspective-taking, privacy cues, and photo valence impact social media photo sharing decisions, revealing surprising findings about privacy considerations.
Cyber Insurance - Technical Challenges and a System Security Roadmap
Explore cyber insurance's growth, challenges, and future directions. Discover how data-driven methodologies and automated tools can enhance risk assessment and management in this evolving field.
Humpty Dumpty - Controlling Word Meanings via Corpus Poisoning
Explore how attackers can manipulate word embeddings through corpus modifications, affecting downstream NLP tasks and fooling defenses. Learn about implications for information retrieval and translation.
JIT Leaks - Inducing Timing Side Channels through Just-In-Time Compilation
Explore how just-in-time compilation can introduce timing side channels in software, enabling attackers to infer sensitive information through observable resource usage imbalances.
HydRand - Efficient Continuous Distributed Randomness
Explore HydRand, a novel protocol for generating continuous, unpredictable, and bias-resistant randomness in distributed systems, improving scalability and ensuring reliable output delivery.
Security Update Labels - Establishing Economic Incentives for Security Patching of IoT Consumer Products
Explore how mandatory security update labels for IoT devices can incentivize manufacturers to improve product security and influence consumer choices in the expanding IoT market.
Hijacking Transient Execution through Microarchitectural Load Value Injection
Explore microarchitectural vulnerabilities and load value injection techniques to understand transient execution hijacking in modern processors.
Automatically Detecting Bystanders in Photos to Reduce Privacy Risks
Explore techniques for automatically identifying bystanders in photos to enhance privacy protection, using visual cues and machine learning models to detect non-primary subjects in images.
High Precision Open-World Website Fingerprinting
Enhancing precision in open-world website fingerprinting attacks, optimizing classifiers to identify browsed pages from packet metadata with high accuracy across various scenarios.
A Comparative Usability Study of FIDO2 Passwordless Authentication
Explore FIDO2 passwordless authentication's usability and user acceptance through a large-scale lab study, revealing insights on perception, concerns, and recommendations for widespread adoption.
Towards Effective Differential Privacy Communication for Users' Data Sharing Decision and Comprehension
Exploring user comprehension and data sharing decisions in differential privacy, focusing on effective communication strategies for laypersons in health app settings.
SoK - Sanitizing for Security
Overview of dynamic bug-finding tools (sanitizers) for C/C++, their security vulnerability coverage, performance, and trade-offs.
On the Security of Two-Round Multi-Signatures
Analyzes security flaws in two-round multi-signature schemes, presents attacks, and proposes mBCJ as a secure alternative for large-scale collaborative signing applications.
Kiss from a Rogue - Evaluating Detectability of Pay-at-the-Pump Card Skimmers
Explore the effectiveness of security measures against card skimmers at gas pumps, including consumer-facing indicators and detection apps, through comprehensive analysis and real-world data.
Stealthy Porn - Understanding Real World Adversarial Images for Illicit Online Promotion
Explore real-world adversarial techniques used to evade image-based detection in online porn promotion, analyzing evasion methods and their effectiveness against popular content detectors.
Why Does Your Data Leak? Uncovering the Data Leakage in Cloud from Mobile Apps
Explores root causes of data leaks in cloud-based mobile apps, revealing authentication and permission issues. Presents automated analysis techniques to identify vulnerabilities in cloud API usage.
Dangerous Skills - Understanding and Mitigating Security Risks of Voice-Controlled Third-Party Functions on Virtual Personal Assistant Systems
Explore security vulnerabilities in virtual personal assistants, focusing on voice squatting and masquerading attacks. Learn about risks and mitigation strategies for third-party functions on smart speakers.