A Fuzzing and Protocol Analysis Case-Study of DNP3
Explores vulnerabilities in DNP3, a key SCADA protocol for power systems, revealing design flaws and implementation gaps. Discusses fuzzing results, CVEs, and analyzes the protocol's security addendum.
Dark Matter - Driven By Data
Explore data-driven cybersecurity challenges and solutions with expert Dan Geer in this IEEE symposium keynote, addressing the complexities of modern digital threats and defenses.
Protocol State Machines and Session Languages
Explores protocol state machines and session languages in security, discussing specification, implementation, and testing challenges. Proposes automated inference of formal specifications to improve security.
The Correctness-Security Gap in Compiler Optimization
Explores how compiler optimizations can preserve functionality but violate security guarantees, proposing research to identify and mitigate security errors introduced during optimization.
On Subnormal Floating Point and Abnormal Timing
Explores timing vulnerabilities in x86 floating-point operations, demonstrating practical attacks on Firefox and a privacy-focused database. Introduces a constant-time math library as a potential mitigation.
Program-Adaptive Mutational Fuzzing
Innovative algorithm maximizes bug detection in black-box mutational fuzzing by leveraging symbolic analysis to optimize mutation ratios, resulting in 38.6% more bugs found across 8 applications.
Every Second Counts - Quantifying the Negative Externalities of Cybercrime via Typosquatting
Quantifying harm from typosquatting using intent inference. New metrics and methodology reveal average time cost to users and traffic loss for legitimate sites. Some typosquatters unexpectedly improve latency.
Cross-Architecture Bug Search in Binary Executables
Innovative method for identifying vulnerabilities across different CPU architectures using bug signatures and semantic analysis of binary code, enabling effective security assessments of closed-source software.
Micro-Policies - Formally Verified, Tag-Based Security Monitors
Explore formally verified tag-based security monitors for low-level policies. Learn about dynamic sealing, compartmentalization, control-flow integrity, and memory safety implementation.
SoK - Deep Packer Inspection - A Longitudinal Study of the Complexity of Run-Time Packers
Longitudinal study analyzing run-time packers' complexity and evolution, proposing a taxonomy for measurement and presenting statistics on packer structures used in malware obfuscation.
Signing Me onto Your Accounts through Facebook and Google - A Traffic-Guided Security Study of Commercially Deployed Single-Sign-On Web Services
Explores security vulnerabilities in popular web-based single sign-on systems, uncovering critical flaws that allow unauthorized access to user accounts on major platforms.
Low-Bandwidth Threshold ECDSA via Pseudorandom Correlation Generators
Explore efficient threshold ECDSA using pseudorandom correlation generators, reducing bandwidth requirements for secure distributed signing protocols.
Goshawk - Hunting Memory Corruptions via Structure-Aware and Object-Centric Memory Operation Synopsis
Explore advanced techniques for detecting memory corruptions using structure-aware and object-centric approaches, enhancing software security and reliability.
GREBE - Unveiling Exploitation Potential for Linux Kernel Bugs
Explore GREBE, a tool for assessing Linux kernel bug exploitability. Learn about its methodology, implementation, and effectiveness in identifying high-risk vulnerabilities.
ShorTor - Improving Tor Network Latency via Multi-hop Overlay Routing
Explore innovative techniques to enhance Tor network performance through multi-hop overlay routing, reducing latency and improving user experience while maintaining anonymity.
Waldo - A Private Time-Series Database from Function Secret-Sharing
Explore innovative function secret-sharing techniques for building a private time-series database, enhancing data security and confidentiality in distributed systems.
Publicly Accountable Robust Multi-Party Computation
Explore innovative techniques for secure multi-party computation, focusing on public accountability and robustness in distributed systems and cryptographic protocols.
DeepCoFFEA - Improved Flow Correlation Attacks on Tor via Metric Learning and Amplification
Explore advanced flow correlation attacks on Tor using metric learning and amplification techniques, enhancing network security understanding and defense strategies.
Deployment of Source Address Validation by Network Operators - A Randomized Control Trial
Explore a randomized control trial on source address validation deployment by network operators, examining effectiveness and implications for cybersecurity practices.
Robbery on DevOps - Understanding and Mitigating Illicit Cryptomining on Continuous Integration Service Platforms
Explore illicit cryptomining on CI platforms: understanding attack methods, impacts, and mitigation strategies to protect DevOps environments from unauthorized resource exploitation.
Exploit the Last Straw That Breaks Android Systems
Uncover vulnerabilities in Android systems through advanced exploitation techniques, focusing on critical weaknesses that can compromise device security and user data.