Stack Overflow Considered Harmful - The Impact of Copy & Paste on Android Application Security
Explores the security implications of developers copying code from Stack Overflow into Android apps, revealing alarming rates of insecure snippet usage in popular applications.
Toward a LangSec Software Development Lifecycle
Explore the integration of Language-theoretic Security principles into software development lifecycles, enhancing security and reliability in system design and implementation.
Helping Johnny to Analyze Malware - A Usability-Optimized Decompiler and Malware Analysis User Study
Explore a usability-optimized decompiler for malware analysis, featuring readability improvements that significantly enhance analysts' ability to understand and combat complex malicious software.
Creating a Distributed Round Robin Scheduler with Etcd
Explore the challenges and insights of building a distributed round-robin scheduler using etcd for persistence and consensus in this developer-focused journey.
GRIMOIRE - Synthesizing Structure while Fuzzing
Innovative fuzzing technique for programs with structured inputs, synthesizing complex structures on-the-fly without pre-configuration, outperforming existing methods and uncovering 19 memory corruption bugs.
MadFS - Per-File Virtualization for Userspace Persistent Memory Filesystems
Explores per-file virtualization for userspace persistent memory filesystems, introducing MadFS with embedded metadata, crash consistency, and optimistic concurrency control for improved performance and scalability.
A Fuzzing and Protocol Analysis Case-Study of DNP3
Explores vulnerabilities in DNP3, a key SCADA protocol for power systems, revealing design flaws and implementation gaps. Discusses fuzzing results, CVEs, and analyzes the protocol's security addendum.
Protocol State Machines and Session Languages
Explores protocol state machines and session languages in security, discussing specification, implementation, and testing challenges. Proposes automated inference of formal specifications to improve security.
On Subnormal Floating Point and Abnormal Timing
Explores timing vulnerabilities in x86 floating-point operations, demonstrating practical attacks on Firefox and a privacy-focused database. Introduces a constant-time math library as a potential mitigation.
Program-Adaptive Mutational Fuzzing
Innovative algorithm maximizes bug detection in black-box mutational fuzzing by leveraging symbolic analysis to optimize mutation ratios, resulting in 38.6% more bugs found across 8 applications.
IRQDebloat - Reducing Driver Attack Surface in Embedded Devices
Explore techniques to reduce attack surfaces in embedded device drivers through IRQ debloating, binary analysis, and fuzzing. Learn about challenges, implementation, and evaluation methods.
Testing Database Engines via Pivoted Query Synthesis
Innovative approach to detect logic bugs in database systems using Pivoted Query Synthesis, demonstrating high effectiveness in finding and fixing issues in major DBMSs.
FuzzUSB - Hybrid Stateful Fuzzing of USB Gadget Stacks
Explore hybrid stateful fuzzing techniques for USB gadget stacks, enhancing security testing and vulnerability detection in USB device implementations.
K-Scheduler - Effective Seed Scheduling for Fuzzing with Graph Centrality Analysis
Explore effective seed scheduling for fuzzing using graph centrality analysis, enhancing software testing efficiency and vulnerability detection.
PGPATCH - Policy-Guided Logic Bug Patching for Robotic Vehicles
Explore an innovative approach to automatically detect and patch logic bugs in robotic vehicle software, enhancing safety and reliability in autonomous systems.
Wobfuscator - Obfuscating JavaScript Malware via Opportunistic Translation to WebAssembly
Explore innovative techniques for obfuscating JavaScript malware through WebAssembly translation, enhancing code protection and evading detection mechanisms.
How Does Usable Security Not End Up in Software Products - Results From a Qualitative Interview Study
Explore findings from qualitative interviews on the challenges of implementing usable security in software products, revealing insights for developers and security professionals.
BEACON - Directed Grey-Box Fuzzing with Provable Path Pruning
Explore advanced grey-box fuzzing techniques with provable path pruning, enhancing software testing efficiency and vulnerability detection in complex systems.
NEUZZ - Efficient Fuzzing with Neural Program Smoothing
Innovative fuzzing technique using neural networks to approximate program behavior, enabling more efficient bug discovery and higher code coverage in software testing.
Learning from Mutants - Using Code Mutation to Learn and Monitor Invariants of a Cyber-Physical System
Innovative approach to automatically construct CPS models using supervised machine learning on data from systematically seeded software faults, demonstrating efficacy in detecting various attacks on a water purification plant simulator.
Jigsaw - Efficient and Scalable Path Constraints Fuzzing
Explore efficient and scalable path constraints fuzzing techniques with Jigsaw, enhancing software testing and vulnerability detection for improved system security and reliability.