Control-Flow Bending - On the Effectiveness of Control-Flow Integrity
Explores Control-Flow Bending attacks on Control-Flow Integrity defenses, revealing vulnerabilities in fine-grained CFI implementations and demonstrating the necessity of shadow stacks for enhanced security against memory corruption.
Protecting Privacy of BLE Device Users
Explores BLE device privacy vulnerabilities and introduces BLE-Guardian, a system protecting user privacy by controlling device discovery and access without modifying existing devices or protocols.
K-Fingerprinting - A Robust Scalable Website Fingerprinting Technique
Explores k-fingerprinting, a robust website fingerprinting technique using random decision forests, demonstrating high accuracy in identifying visited web pages through encrypted connections.
A Systems Approach to Safety and Cybersecurity
Explore systems thinking for safety and cybersecurity, integrating approaches to manage emergent properties and control problems in complex systems.
A Usability Study of Five Two-Factor Authentication Methods
Comprehensive usability study comparing five two-factor authentication methods, examining setup procedures, user experiences, and preferences to inform better security implementations for online accounts.
Why People - Don't - Use Password Managers Effectively
Explores user attitudes towards password managers, revealing differences between built-in and separate tool users, and provides insights to improve adoption and effective usage of these security tools.
Keepers of the Machines - Examining How System Administrators Manage Software Updates
Examining system administrators' software update management practices, challenges, and potential improvements for multiple machines to enhance organizational cybersecurity.
Privacy and Security Threat Models and Mitigation Strategies of Older Adults
Explores privacy and security perceptions of older adults using smart technologies, identifying unique challenges, misconceptions, and mitigation strategies to inform better design and protection measures.
Personal Information Leakage by Abusing the GDPR 'Right of Access'
Explores GDPR 'Right of Access' vulnerabilities, revealing how impersonation tactics can lead to unauthorized data access. Offers insights on improving identity verification processes for enhanced data protection.
The Effect of Entertainment Media on Mental Models of Computer Security
Explores how entertainment media shapes people's understanding of computer security, identifying misconceptions from fictional tropes and examining how viewers evaluate realism in portrayals.
Small World with High Risks - A Study of Security Threats in the npm Ecosystem
Analyzes security risks in npm ecosystem, revealing vulnerabilities due to dependencies, maintainer influence, and lack of maintenance. Discusses potential mitigations for the JavaScript community.
Tackling the Trust and Safety Crisis
Exploring challenges in building safe, trustworthy tech products for billions globally, drawing from past mistakes and suggesting ways forward in this complex, multidisciplinary issue.
Protecting Accounts from Credential Stuffing with Password Breach Alerting
Explore a privacy-preserving protocol for detecting exposed credentials, its implementation as a cloud service, and its effectiveness in prompting users to update compromised passwords.
In-toto - Providing Farm-to-Table Guarantees for Bits and Bytes
Explore in-toto, a framework ensuring software supply chain integrity from inception to deployment, addressing vulnerabilities and protecting millions of users across various cloud environments.
Reading the Tea Leaves - A Comparative Analysis of Threat Intelligence
Comparative analysis of threat intelligence sources, evaluating metrics, coverage, and effectiveness for cybersecurity defense. Highlights limitations and challenges in using existing data.
From Privacy by Design to Data Protection by Design - The Challenges of Turning Good Practice into a Legal Obligation
Exploring challenges of implementing Data Protection by Design under GDPR, including legal obligations, assessment criteria, and the role of privacy engineering in meeting comprehensive demands.
Inadvertently Making Cyber Criminals Rich - A Comprehensive Study of Cryptojacking Campaigns at Internet Scale
Comprehensive study on cryptojacking campaigns, revealing underestimated scale, infection methods, and prevalence across the internet. Insights on mining services, attack vectors, and compromised third-party software.
Not Everything is Dark and Gloomy - Power Grid Protections Against IoT Demand Attacks
Explores IoT demand attacks on power grids, analyzing cascading outages and system vulnerabilities. Presents findings from a large-scale North American grid study, discussing protective measures and future challenges.
Discovering and Understanding the Security Hazards in the Interactions between IoT Devices, Mobile Apps, and Clouds on Smart Home Platforms
Exploring security vulnerabilities in smart home platforms through reverse engineering and phantom device testing, revealing unexpected state transitions and potential attacks.
Opaque - An Oblivious and Encrypted Distributed Analytics Platform
Explore Opaque, a distributed analytics platform offering strong security for sensitive data through encryption, authentication, and oblivious operators, with optimized performance on Spark SQL.
Lock It and Still Lose It - On the -In-Security of Automotive Remote Keyless Entry Systems
Unveils vulnerabilities in automotive remote keyless entry systems, demonstrating how attackers can exploit flaws to gain unauthorized access to vehicles from major manufacturers.