Security and Privacy Failures in Popular 2FA Apps
Uncovers security and privacy vulnerabilities in popular two-factor authentication apps, highlighting risks in backup mechanisms and recommending improvements for TOTP implementations.
Fast Identity Online with Anonymous Credentials - FIDO-AC
Explores combining FIDO2 authentication with anonymous credentials, enhancing privacy and security in online identity verification while maintaining user control over attribute disclosure.
Improving Logging to Reduce Permission Over-Granting Mistakes
Explores techniques to enhance logging in server applications, aiming to reduce permission over-granting mistakes by system administrators when resolving access-deny issues.
Combating Robocalls with Phone Virtual Assistant Mediated Interaction
Innovative approach using NLP-based virtual assistant to combat robocalls by vetting incoming calls, preserving user experience while effectively blocking spoofed and automated calls.
Squint Hard Enough - Attacking Perceptual Hashing with Adversarial Machine Learning
Explores vulnerabilities in perceptual hash matching systems used for detecting illicit content, demonstrating potential for targeted attacks and detection avoidance in online communications.
zkSaaS - Zero-Knowledge SNARKs as a Service
Explore zkSaaS, a framework for faster zk-SNARK computation by distributing proof generation across multiple servers while preserving privacy and achieving significant speed-ups.
MTSan - A Feasible and Practical Memory Sanitizer for Fuzzing COTS Binaries
Discover MTSan, a hardware-assisted memory sanitizer for binary fuzzing. Learn about its novel object recovery scheme, binary rewriting solution, and use of ARM Memory Tagging Extension to enhance effectiveness and reduce overhead.
Continuous Learning for Android Malware Detection
Innovative approach combining contrastive and active learning to combat concept drift in Android malware detection, improving accuracy and consistency over time.
Log - It’s Big, It’s Heavy, It’s Filled with Personal Data! Measuring the Logging of Sensitive Information in the Android Ecosystem
Explores Android's logging system, revealing how sensitive user data is inadvertently exposed through system logs and preinstalled apps, raising privacy concerns in the mobile ecosystem.
Humans vs. Machines in Malware Classification
Experimental study comparing human and machine approaches to malware classification, revealing insights into feature prioritization and decision-making processes for both novice and expert analysts.
Towards a Proactive ML Approach for Detecting Backdoor Poison Samples
Proactive approach to detect backdoor poison samples in ML models, using Confusion Training to expose backdoor patterns and improve defense against various attacks.
Duoram - A Bandwidth-Efficient Distributed ORAM for 2- and 3-Party Computation
Innovative distributed ORAM protocol for secure computation, offering significant bandwidth efficiency and performance improvements through novel vector dot product evaluation techniques.
Fine-Grained Poisoning Attack to Local Differential Privacy Protocols for Mean and Variance Estimation
Explores a new fine-grained attack on local differential privacy protocols, allowing manipulation of mean and variance estimations. Discusses security-privacy consistency and proposes a defense method.
Content-Type - multipart/oracle - Tapping into Format Oracles in Email End-to-End Encryption
Explores format oracle vulnerabilities in email encryption, analyzing MIME and IMAP interactions to uncover side-channels that leak decryption status in email clients, proposing countermeasures for improved security.
CyberRisk - This is The Way
Reflexión sobre la importancia de los riesgos en ciberseguridad, enfocándose en la observación objetiva y subjetiva para detectar amenazas, resolver problemas y tomar mejores decisiones en ciberincidentes.
Kernel Live Patching for Clang LTO Kernel
Exploring live patching for Clang-built LTO kernels: challenges, solutions, and potential improvements in kpatch implementation for enhanced scalability and compatibility.
Unlocking the Web - Exploring WebAuthn & Beyond
Explore WebAuthn, passwordless authentication, and cloud computing challenges with insights on data privacy, Kubernetes, and the future of web security.
The One Where We Threat Model During Development
Explore threat modeling as a development tool, learning its principles, techniques, and value for developers, managers, and testers. Gain insights on implementing continuous threat modeling and using Pytm for a Pythonic approach.
Practical Data Privacy
Explore practical data privacy implementation with open-source libraries, privacy-enhancing technologies, and strategies for balancing privacy and utility in software development and data science projects.
Reverse Engineering RGB Keyboard Backlights With Linux Kernel Drivers
Explore reverse engineering Windows RGB keyboard drivers and implementing Linux kernel drivers for HP laptops. Learn techniques for dotnet/Windows apps and contributing to the Linux kernel.
Demystify Secure Software Supply Chain Metadata
Explore secure software supply chain concepts, including SBOMs, SLSA, and attestations. Learn to create container images with signed metadata using Docker tools and GitHub Actions.