USENIX Security '18
2018-08-15..2018-08-17
Baltimore, United States
| title | author | length |
|---|---|---|
| Q: Why Do Keynote Speakers Keep Suggesting That Improving Security Is Possible? | James Mickens | 51m |
Argues that machine learning is often opaque yet rolled into mission‑critical systems, cites criminal‑justice risk scores that label Black defendants twice the… | ||
| Fear the Reaper: Characterization and Fast Detection of Card Skimmers | Nolen Scaife, Christian Peeters, Patrick Traynor | 22m |
Study analyzes 35 unique skimmers from a 16-month NYPD bolo dataset and finds 69% are overlays or deep-inserts with 1.5 mm contact read heads and metallic… | ||
| BlackIoT: IoT Botnet of High Wattage Devices Can Disrupt the Power Grid | Saleh Soltan, Prateek Mittal, H. Vincent Poor | 26m |
Paper demonstrates MadIoT attacks: coordinated switching of Wi‑Fi high‑wattage loads (ACs ~1 kW, water heaters ~5 kW) using state‑of‑the‑art simulators on real… | ||
| Skill Squatting Attacks on Amazon Alexa | Deepak Kumar, Riccardo Paccagnella, Paul Murley, Eric Hennenfent, Joshua Mason, Adam Bates, Michael Bailey | 26m |
Researchers send 11,460 single-word US English samples to Alexa 50 times each (573,000 transcriptions) and find 24 words yield predictable misinterpretations… | ||
| CommanderSong: A Systematic Approach for Practical Adversarial Voice Recognition | Xuejing Yuan, Yuxuan Chen, Yue Zhao, Yunhui Long, Xiaokang Liu, Kai Chen, Shengzhi Zhang, Heqing Huang, XiaoFeng Wang, Carl A. Gunter | 24m |
Automatically generates stealthy voice commands embedded into real songs so ASR decoders accept phrases while human listeners do not. Uses an open-source… | ||
| ACES: Automatic Compartments for Embedded Systems | Abraham A Clements, Naif Saleh Almakhdhub, Saurabh Bagchi, Mathias Payer | 20m |
ACES is an LLVM-based compiler that auto-infers compartments for bare‑metal embedded code, uses static analysis plus a micro‑emulator and the MPU to enforce… | ||
| IMIX: In-Process Memory Isolation EXtension | Tommaso Frassetto, Patrick Jauernig, Christopher Liebchen, Ahmad-Reza Sadeghi | 23m |
IMIX extends x86 with a new memory-access permission and a compact SMOVE instruction that only touches marked pages, enforces two isolation rings at page… | ||
| HeapHopper: Bringing Bounded Model Checking to Heap Implementation Security | Moritz Eckert, Antonio Bianchi, Ruoyu Wang, Yan Shoshitaishvili, Christopher Kruegel, Giovanni Vigna | 22m |
HeapHopper brings bounded model checking plus symbolic execution (uses angr) to concrete heap allocators, encoding up to a bounded number of transactions… | ||
| Guarder: A Tunable Secure Allocator | Sam Silvestro, Hongyu Liu, Tianyi Liu, Zhiqiang Lin, Tongping Liu | 22m |
Guarder guarantees a user-specified lower bound of randomization entropy and implements it with per-thread allocation/deallocation circular buffers sized at… | ||
| Fp-Scanner: The Privacy Implications of Browser Fingerprint Inconsistencies | Antoine Vastel, Pierre Laperdrix, Walter Rudametkin, Romain Rouvoy | 21m |
FP-Scanner probes four axes—operating system, browser, device and canvas—for cross-attribute contradictions and flags modified fingerprints. The authors build… | ||
| Who Left Open the Cookie Jar? | Gertjan Franken, Tom Van Goethem, Wouter Joosen | 20m |
A black-box framework uses Selenium, a controllable web server and a proxy to run comprehensive tests and a distributed crawler over the Alexa top 10k (160k… | ||
| Effective Detection of Multimedia Protocol Tunneling using Machine Learning | Diogo Barradas, Nuno Santos, Luís Rodrigues | 22m |
Compares three tools Facet, CovertCast, DeltaShaper using 1,000 Skype traces for Facet (1,000 cover), 300/300 for DeltaShaper, 200/200 for CovertCast; finds… | ||
| Quack: Scalable Remote Measurement of Application-Layer Censorship | Benjamin VanderSloot, Allison McDonald, Will Scott, J. Alex Halderman, Roya Ensafi | 27m |
Quack is a remote measurement system that uses the RFC 862 echo servers (port 7) as reflectors to detect application‑layer blocking, operating on ~47,000… | ||
| Studying the Impact of Managers on Password Strength and Reuse | Sanam Ghorbani Lyastani, Michael Schilling, Sascha Fahl, Michael Backes, Sven Bugiel | 26m |
Large-scale study combines 476 survey participants with 170 browser-plugin users to measure real passwords (average 10 accounts, 6 distinct passwords)… | ||
| Forgetting of Passwords: Ecological Theory and Data | Xianyi Gao, Yulong Yang, Can Liu, Christos Mitropoulos, Janne Lindqvist, Antti Oulasvirta | 19m |
Paper adapts ecological theory of long‑term memory and derives ACT‑R–style models that predict login duration and recall odds, validated in a month‑long field… | ||
| The Rewards and Costs of Stronger Passwords in a University: Linking Password Lifetime to Strength | Ingolf Becker, Simon Parkin, M Angela Sasse | 25m |
University password policy links Shannon entropy to lifetime so 50 bits = 100 days up to 120 bits = 350 days. Study uses an institution of ~100,000 accounts… | ||
| Rethinking Access Control and Authentication for the Home Internet of Things | Weijia He, Maximilian Golla, Roshni Padhi, Jordan Ofek, Markus Dürmuth, Earlence Fernandes, Blase Ur | 25m |
Argues access control should be capability‑centric rather than per‑device and demonstrates this with a 425‑participant online study that tests 22 capabilities… | ||
| ATtention Spanned: Comprehensive Vulnerability Analysis of AT Commands Within the Android Ecosystem | Dave (Jing) Tian, Grant Hernandez, Joseph I. Choi, Vanessa Frost, Christie Ruales, Patrick Traynor, Hayawardh Vijayakumar, Lee Harrison, Amir Rahmati, Michael Grace, Kevin R. B. Butler | 23m |
Researchers extract 3,500 AT commands from over 2,000 Android firmware images across 11 vendors, build an automated USB tester that talks to phones over the… | ||
| Charm: Facilitating Dynamic Analysis of Device Drivers of Mobile Systems | Seyed Mohammadjavad Seyed Talebi, Hamid Tavakoli, Hang Zhang, Zheng Zhang, Ardalan Amiri Sani, Zhiyun Qian | 22m |
System runs mobile device drivers inside an x86 VM via remote device driver execution and a custom low-latency USB channel that forwards register I/O… | ||
| Inception: System-Wide Security Testing of Real-World Embedded Systems Software | Nassim Corteggiani, Giovanni Camurati, Aurélien Francillon | 24m |
A framework that merges LLVM bitcode from C/C++, hand‑written assembly, raw binaries and a partial processor model to preserve source semantics and run… | ||
| Acquisitional Rule-based Engine for Discovering Internet-of-Things Devices | Xuan Feng, Qiang Li, Haining Wang, Limin Sun | 23m |
ARE automatically generates discovery rules without training data by matching application-layer responses from devices to crawled product pages, defining a… | ||
| Privacy for Tigers | Ross Anderson | 44m |
Mobile GPS tags (thumb-sized, call home three times a day for five years) and camera-trap/photo aggregation power new poaching risks; analysis finds 5–10% of… | ||
| Cybersecurity: Is It about Business or Technology? | Donna Dodson | 47m |
NIST argues cybersecurity is risk management tied to business outcomes, not just tech: it builds the CSF with five functions — identify protect detect respond… | ||
| A Sense of Time for JavaScript and Node.js | James C. Davis, Eric R. Williamson, Dongyoon Lee | 21m |
Defines Event Handler Poisoning (EHP) as a denial-of-service that blocks the event loop or small worker pool, mines a 1,132-vuln NPM dataset and finds ~35%… | ||
| Freezing the Web: A Study of ReDoS Vulnerabilities in JavaScript-based Web Servers | Cristian-Alexandru Staicu, Michael Pradel | 21m |
A methodology links module-level regexp flaws to live Node.js servers by finding vulnerable NPM regexes (module deemed vulnerable if a crafted 80,000‑char… | ||
| NAVEX: Precise and Scalable Exploit Generation for Dynamic Web Applications | Abeer Alhuzali, Rigel Gjomemo, Birhanu Eshete, V.N. Venkatakrishnan | 27m |
NAVEX combines static source analysis and dynamic crawling to build an enhanced code property graph (with sanitization and DB-constraint tags), a navigation… | ||
| Rampart: Protecting Web Applications from CPU-Exhaustion Denial-of-Service Attacks | Wei Meng | 24m |
Rampart: Protecting Web Applications from CPU-Exhaustion Denial-of-Service Attacks
Wei Meng
Chinese University of Hong Kong
Abstract:
Denial-of-Service… | ||
| How Do Tor Users Interact With Onion Services? | Anne Edmundson | 23m |
Study uses 17 interviews, a 517‑response survey and two days of B root data with 15,000 unique onion domains to quantify usability problems. Users report… | ||
| Towards Predicting Efficient and Anonymous Tor Circuits | Armon Barton | 23m |
PredicTor uses a Random Forest trained on active probes and is PredicTor implemented in Tor source and shipped via the consensus; Shadow and live Tor tests… | ||
| BurnBox: Self-Revocable Encryption in a World Of Compelled Access | Nirvan Tyagi | 26m |
BurnBox delivers self-revocable encryption for cloud files: per-file symmetric keys live in an on-device erasable index and a public-key “restoration… | ||
| An Empirical Analysis of Anonymity in Zcash | George Kappos | 22m |
Blockchain analysis shows 85% of Zcash activity stays transparent, private z-to-z transactions are under 1%, and deposits/withdrawals around the shielded pool… | ||
| Rethinking Architectures and Abstraction for a World Where Security Improvements Matter More than Performance Gains | Paul Kocher | 46m |
Argues that Spectre as symptom reveals a wide gap between architectural guarantees and what software actually needs, citing side channels, Rowhammer… | ||
| Solving the Next Billion-People Privacy Problem | Monica Lam | 49m |
Argues that virtual assistants risk becoming the next monopoly privacy sink and proposes an open, federated stack: an open-source assistant Almond, a… | ||
| SAD THUG... | Jonathan P. Chapman | 22m |
SAD THUG detects malware hiding data in image file structure by modeling clean files as a finite-state automaton and flagging structural deviations; trained on… | ||
| Opening Remarks and Awards | William Enck, Adrienne Porter Felt | 24m |
Conference opens with concrete metrics: 100 accepted papers, a sold‑out crowd of 785+ attendees, and 524 submissions this cycle. Program work uses an 86‑member… | ||
| Unveiling and Quantifying Facebook Exploitation of Sensitive Personal Data for Advertising Purposes | José González Cabañas | 25m |
Analysis uses data from 45,500 real Facebook users yielding ~5 million interest assignments (126,000 unique), scores each interest with semantic-similarity to… | ||
| Analysis of Privacy Protections in Fitness Tracking Social Networks -or- You can run, but can you hide? | Wajih Ul Hassan | 23m |
This study scrapes 21 million posts from a popular fitness service and finds 16.5% of users enable circular Endpoint Privacy Zones (EPZs). A geometry +… | ||
| AttriGuard: A Practical Defense Against Attribute Inference Attacks via Adversarial Machine Learning | Jinyuan Jia | 26m |
AttriGuard: A Practical Defense Against Attribute Inference Attacks via Adversarial Machine Learning
Jinyuan Jia
Iowa State University
Abstract:
Users in… | ||
| Polisis: Automated Analysis and Presentation of Privacy Policies Using Deep Learning | Hamza Harkous | 25m |
Polisis uses a privacy-focused language model trained on 130K privacy policies and a hierarchy of 21 neural classifiers to label policy segments, then answers… | ||
| Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels | Damian Poddebniak | 22m |
Research demonstrates a concrete break of end-to-end email encryption by injecting chosen plaintext into encrypted messages and triggering network callbacks… | ||
| The Dangers of Key Reuse: Practical Attacks on IPsec IKE | Dennis Felsch | 26m |
Reuses a single RSA key pair across IKEv1 modes and IKEv2 signatures to turn PKCS#1 v1.5 padding into a Bleichenbacher oracle that lets a MITM decrypt… | ||
| One&Done: A Single-Decryption EM-Based Attack on OpenSSL’s Constant-Time Blinded RSA | Monjur Alam | 28m |
One&Done: A Single-Decryption EM-Based Attack on OpenSSL’s Constant-Time Blinded RSA
Monjur Alam
Georgia Tech
Abstract:
This paper presents the first side… | ||
| DATA – Differential Address Trace Analysis: Finding Address-based Side-Channels in Binaries | Samuel Weiser | 24m |
DATA is a dynamic binary tool that records full address traces via binary instrumentation, realigns traces with a novel re-alignment algorithm, and applies a… | ||
| Analogy Cyber Security—From 0101 to Mixed Signals | Wenyuan Xu | 45m |
Demonstrates concrete attacks that corrupt sensors’ outputs and cascade to systems: inaudible ultrasonic commands activate phones and voice assistants by… | ||
| Chipmunk or Pepe? Using Acoustical Analysis to Detect Voice-Channel Fraud | Vijay Balasubramaniyan | 49m |
Detects voice‑channel takeover by combining 1380 audio features (non‑voiced noise spectra, voiced vocal‑tract models, signaling/ANI velocity) into an audio… | ||
| The Battle for New York: A Case Study of Applied Digital Threat Modeling at the Enterprise Level | Rock Stevens | 19m |
Formalized threat modeling using the center-of-gravity framework produces actionable defense plans in about 37 minutes per person and yields measurable… | ||
| SAQL: A Stream-based Query System for Real-Time Abnormal System Behavior Detection | Peng Gao | 26m |
Built a stream query engine called SAQL with a domain-specific language for rule-, time-series-, invariant-, and outlier-based anomalies, using stateful… | ||
| Practical Accountability of Secret Processes | Jonathan Frankle | 25m |
Federal electronic-surveillance orders get cryptographic commitments posted to a tamper‑resistant ledger, companies and agencies post zero‑knowledge SNARK… | ||
| DIZK: A Distributed Zero Knowledge Proof System | Howard Wu | 19m |
A distributed ZK-SNARK system that actually runs the setup and prover across a cluster and reaches billions of gates instead of millions. Implements a tailored… | ||
| NetHide: Secure and Practical Network Topology Obfuscation | Roland Meier | 24m |
NetHide formulates topology obfuscation as a multi-objective optimization, samples forwarding behaviors, and implements the dataplane logic in P4 to intercept… | ||
| Towards a Secure Zero-rating Framework with Three Parties | Zhen Zhang | 22m |
ZFree proposes a practical defense that prevents free‑riding by binding ISP zero‑rating to cryptographic per‑packet tags: server agents mirror outgoing packets… | ||
| MoonShine: Optimizing OS Fuzzer Seed Selection with Trace Distillation | Shankara Pailoor | 24m |
Takes 2.8 million system calls from 3,220 real programs and uses trace distillation to compress them to just over 14,000 calls while preserving 86% of original… | ||
| QSYM : A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing | Insu Yun | 24m |
A fast concolic engine called QSYM implements instruction-level symbolic emulation by removing the IR layer and tightly integrating symbolic emulation with… | ||
| Automatic Heap Layout Manipulation for Exploitation | Sean Heelan | 21m |
Automatic heap-layout tool SHRIKE targets PHP by extracting allocator-interacting fragments from 11,000 regression tests, fuzzing them, and stitching sequences… | ||
| FUZE: Towards Facilitating Exploit Generation for Kernel UAF Vulnerabilities | Wei Wu | 21m |
FUZE: Towards Facilitating Exploit Generation for Kernel Use-After-Free Vulnerabilities
Wei Wu
University of Chinese Academy of Sciences; Pennsylvania State… | ||
| The Secure Socket API: TLS as an Operating System Service | Mark O'Neil | 26m |
Argues that TLS belongs at the socket layer and demonstrates a prototype Secure Socket API implemented as a small kernel module that offloads crypto and… | ||
| Return Of Bleichenbacher’s Oracle Threat (ROBOT) | Hanno Bock | 24m |
Large-scale scans of TLS servers find real Bleichenbacher oracles: almost a third of the top 100 domains and many in an Alexa Top 1M sweep are affected… | ||
| Bamboozling Certificate Authorities with BGP | Henry Birge-Lee | 23m |
Shows that BGP manipulations let an adversary obtain real CA-signed certificates by hijacking validation traffic: experiments use peering testbed prefixes to… | ||
| The Broken Shield: Measuring Revocation Effectiveness in the Windows Code-Signing PKI | Doowon Kim | 22m |
Researchers collect seven datasets, build a pipeline to map code‑signing certificates to Windows CRL/OCSP endpoints, and measure revocation end‑to‑end. Key… | ||
| Debloating Software through Piece-Wise Compilation and Loading | Anh Quach | 26m |
Study measures show only 5% of libc is used on average across 2,000 Ubuntu programs and vlc uses about 18–21%. A compiler+loader system writes a dependency… | ||
| Precise and Accurate Patch Presence Test for Binaries | Hang Zhang | 23m |
FIBER parses open-source security patches, extracts small, high-value change sites, and translates them into fine-grained binary signatures that combine local… | ||
| From Patching Delays to Infection Symptoms: Using Risk Profiles for an Early Discovery of Vulnerabilities Exploited in the Wild | Chaowei Xiao | 23m |
Compares ISP-level patch-deployment risk profiles (from host software footprints tied to NVD CVEs) against symptom communities derived from spam blacklists… | ||
| Understanding the Reproducibility of Crowd-reported Security Vulnerabilities | Dongliang Mu | 28m |
Manual reproduction of 368 crowd-reported memory-error vulnerabilities uses 3600 man-hours and finds very low reproducibility: a 256-case subset from… | ||
| Malicious Management Unit: Why Stopping Cache Attacks in Software is Harder Than You Think | Stephan van Schaik | 23m |
Presents a new translation-probe indirect cache attack that lures the MMU into leaking victim cache usage by abusing page-table walks and undocumented… | ||
| Translation Leak-aside Buffer: Defeating Cache Side-channel Protections | Ben Gras | 27m |
Shows a practical TLB-based channel that bypasses cache defenses by reverse-engineering Intel TLB hashing, building a probe that times L1/L2 translation sets… | ||
| Meltdown: Reading Kernel Memory from User Space | Moritz Lipp | 23m |
Meltdown demonstrates that out of order execution leaks kernel memory by executing transient instructions that encode secret bytes into the cache and… | ||
| Foreshadow: Extracting the Keys to the Intel SGX Kingdom... | Jo Van Bulck | 25m |
The talk explains Foreshadow, a software-only microarchitectural attack that exploits a speculative execution bug in modern Intel CPUs to break Intel SGX… | ||
| Plug and Prey? Measuring the Commoditization of Cybercrime via Online Anonymous Markets | Rolf van Wegberg | 25m |
Longitudinal scraping of eight anonymous markets including Silk Road and AlphaBay from 2011–2017 yields 230k listings, ~16k vendors and 4M feedbacks… | ||
| Reading Thieves' Cant: Automatically Identifying & Understanding Dark Jargons... | Kan Yuan | 24m |
An automated system identifies words whose contexts differ between legitimate and underground corpora by training a dual-input word embedding with a shared… | ||
| Schrödinger’s RAT: Profiling Stakeholders in the Remote Access Trojan Ecosystem | Mohammad Rezaeirad | 18m |
Registers expired RAT controller domains and sinkholes them, collecting 153 million connections from 828,137 IPs then filters noise using payload parsing, full… | ||
| The aftermath of a crypto-ransomware attack at a large academic institution | Sonia Chiasson | 19m |
End of 2016 a large North American university refuses a $38,000 ransom after ransomware encrypts many campus Windows machines; 56 of 150 survey respondents… | ||
| Panel: From Spam to Speech: Policing the Next Generation of "Unwanted Traffic" | Nick Feamster, Emma Llansó, Nick Sullivan, Amy X. Zhang, Ben Y. Zhao | 45m |
Automated moderation struggles with scale and nuance: off‑the‑shelf NLP averages 56-58% accuracy while tuned models rise to 75-80%, so false… | ||
| The Law and Economics of Bug Bounties | Amit Elazari Bar On | 48m |
Presents results from reading hundreds of bug‑bounty and VDP terms and finds widespread legal risk for researchers: examples include Kevin walked away from… | ||
| We Still Don’t Have Secure Cross-Domain Requests: an Empirical Study of CORS | Jianjun Chen | 25m |
Empirical analysis of CORS finds concrete, exploitable failures: a content-type prefix bypass lets crafted headers deliver payloads that obtained a remote… | ||
| End-to-End Measurements of Email Spoofing Attacks | Hang Hu | 24m |
Blackbox end-to-end tests scan Alexa domains and send 52,500 spoofed messages to measure real delivery and UI cues, focusing on SPF/DKIM/DMARC records and… | ||
| Who Is Answering My Queries: Understanding and Characterizing Interception of the DNS Resolution Path | Baojun Liu | 20m |
Large-scale measurement finds on-path DNS interception across networks using 148,478 residential and cellular IPs and two measurement methods a residential… | ||
| End-Users Get Maneuvered: Empirical Analysis of Redirection Hijacking in Content Delivery Networks | Shuai Hao | 20m |
Measurement of DNS-based CDN mapping shows attackers can replay legitimately signed records to reroute users to chosen edge servers; DNSSEC—even ECDSA live… | ||
| FANCI : Feature-based Automated NXDomain Classification and Intelligence | Samuel Schüppen | 20m |
FANCI is an NXDomain classifier that uses 21 features (12 structural, 7 linguistic, 2 statistical) and a random forest model trained on DGArchive DGAs and… | ||
| An Empirical Study of Web Resource Manipulation in Real-world Mobile Apps... | Xiaohan Zhang | 22m |
An automated static tool XPMChecker scans 80,694 Google Play apps and finds that 49.2% of detected web-resource manipulations are cross-principal manipulation… | ||
| Fast and Service-preserving Recovery from Malware Infections Using CRIU | Ashton Webster | 26m |
CRIU-MR uses a patched CRIU plus an agent that ingests IDS/IPS JSON alerts, checkpoints a Linux container, omits policy-flagged processes, swaps in a clean… | ||
| The Second Crypto War—What's Different Now | Susan Landau | 49m |
Argument: the current fight centers on locked mobile devices, not abstract end-to-end crypto; San Bernardino shows the FBI told courts only Apple could open a… | ||
| Medical Device Cybersecurity through the FDA Lens | Suzanne B. Schwartz | 43m |
Timeline of FDA actions since 2013: publication of premarket and postmarket guidances, three public workshops, an MOU with NH-ISAC, and MITRE support for a… | ||
| The Guard's Dilemma: Efficient Code-Reuse Attacks Against Intel SGX | Andrea Biondo | 23m |
Demonstrates a practical code‑reuse exploit against Intel SGX that needs no kernel privileges, causes no enclave crashes, and defeats SGX‑Shield by abusing… | ||
| A Bad Dream: Subverting Trusted Platform Module While You Are Sleeping | Seunghun Han | 26m |
Two practical TPM attacks target sleep transitions: a gray area flaw in the TPM 2.0 spec lets an OS skip S3 shutdown notifications and cause PCRs to be reset… | ||
| Tackling runtime-based obfuscation in Android with TIRO | Michelle Y. Wong | 22m |
TIRO implements Target-Instrument-Run-Observe and ships an instrumented ART runtime that detects six concrete runtime tampering techniques (Dex value hooking… | ||
| Discovering Flaws in Security-Focused Static Analysis Tools for Android using Systematic Mutation | Richard Bonett | 21m |
A mutation-based framework called μSE generates Android app mutants using security-focused operators and placement schemes, runs three prominent data-leak… | ||
| With Great Training Comes Great Vulnerability: Practical Attacks against Transfer Learning | Bolun Wang | 22m |
Shows that transfer learning creates a practical black‑box attack that uses a public Teacher model to craft imperceptible perturbations by neuron… | ||
| When Does Machine Learning FAIL? Generalized Transferability for Evasion and Poisoning Attacks | Octavian Suciu | 27m |
Defines the FAIL model (Features, Algorithm, Instances, Leverage) to quantify realistic attacker knowledge and control, and implements StingRay, a targeted… | ||
| teEther: Gnawing at Ethereum to Automatically Exploit Smart Contracts | Johannes Krupp | 24m |
Tool teEther automatically finds vulnerability classes in Ethereum bytecode and synthesizes real exploit transactions from binary bytecode alone. It models… | ||
| Enter the Hydra: Towards Principled Bug Bounties and Exploit-Resistant Smart Contracts | Phil Daian | 25m |
Hydra transforms contracts into N-of-N replicated versions and replaces majority voting with a consensus fault manager that aborts on disagreement, creating an… | ||
| Arbitrum: Scalable, private smart contracts | Harry Kalodner | 20m |
Arbitrum is a prototype blockchain layer that moves smart-contract execution off-chain to managers and uses the on-chain verifier only for disputes, claiming… | ||
| Erays: Reverse Engineering Ethereum's Opaque Smart Contracts | Yi Zhou, Surya Bakshi | 21m |
Erays is a reverse-engineering pipeline that recovers CFGs, lifts EVM stack code into a register IR (uses 1024 registers to model the stack), applies… | ||
| DelegaTEE: Brokered Delegation Using Trusted Execution Environments | Sinisa Matetic | 27m |
System implements brokered delegation with Intel SGX enclaves and a central or peer-to-peer proxy that stores owner credentials but credentials never revealed… | ||
| Simple Password-Hardened Encryption Services | Russell W. F. Lai | 14m |
A concrete password-hardened encryption (PHE) service uses an external crypto server / rate limiter that stores only PRF shares so a compromised service cannot… | ||
| Security Namespace: Making Linux Security Frameworks Available to Containers | Yuqiong Sun | 32m |
Introduces a kernel abstraction called security namespaces that lets each container hold its own IMA and AppArmor state and policy while preserving global… | ||
| Shielding Software From Privileged Side-Channel Attacks | Xiaowan Dong | 24m |
Defends against page-table and last-level-cache side channels a compromised OS can launch by removing page-table mappings from the kernel dirac map, disabling… | ||
| Vetting Single Sign-On SDK Implementations via Symbolic Reasoning | Ronghai Yang | 21m |
Builds an automated tester called S3KVetter that symbolically analyzes compiled SSO SDKs, simulates multi‑party flows by scheduling request orders and… | ||
| O Single Sign-Off, Where Art Thou? An Empirical Analysis of Single Sign-On | Mohammad Ghasemisharif | 22m |
Finds that a cookie hijack of Facebook lets an attacker fully takeover accounts on many sites, demonstrated by capturing 5,700 session cookies from four months… | ||
| WPSE: Fortifying Web Protocols via Browser-Side Security Monitoring | Mauro Tempesta | 17m |
WPSE is a browser-side monitor implemented as a Chrome extension that enforces protocol flow, integrity constraints, and secrecy by replacing tokens with… | ||
| Man-in-the-Machine: Exploiting Ill-Secured Communication Inside the Computer | Thanh Bui | 22m |
An unprivileged co‑user process impersonates IPC endpoints on Windows, macOS and Linux and intercepts sensitive data by binding to localhost sockets, named… | ||
| All Your GPS Are Belong To Us: Towards Stealthy Manipulation of Road Navigation Systems | Kexiong (Curtis) Zeng, Shinan Liu | 25m |
Researchers build a low-cost portable GPS spoofer (~$323) and an algorithm that computes subtle GPS shifts so fake turn-by-turn routes match real road… | ||
| Injected and Delivered: Fabricating Implicit Control over Actuation Systems by Spoofing Inertial Sensors | Yazhou Tu | 21m |
Presents a practical black‑box attack that uses acoustic and vibration signals to spoof MEMS inertial outputs by exploiting a sample rate drift amplification… | ||
| Modelling and Analysis of a Hierarchy of Distance Bounding Attacks | Tom Chothia | 23m |
Extends the applied pi-calculus with location and start/stop timer actions to model distance‑bounding behavior, defines and orders five+ formal security… | ||
| Off-Path TCP Exploit: How Wireless Routers Can Jeopardize Your Secrets | Weiteng Chen | 21m |
Claims a new timing side channel in half‑duplex IEEE 802.11 that enables off-path TCP injection by measuring uplink/downlink contention from a device reachable… | ||
| Formal Security Analysis of Neural Networks using Symbolic Intervals | Shiqi Wang | 22m |
ReluVal uses interval arithmetic and symbolic intervals to compute rigorous output bounds for ReLU networks, then applies iterated interval refinement… | ||
| Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring | Carsten Baum | 27m |
Proposes a watermarking method that hides a secret trigger set — unrelated input-label pairs — inside a classifier so ownership can be proven via black-box… | ||
| A4NT: Author Attribute Anonymity by Adversarial Training of Neural Machine Translation | Rakshith Shetty | 26m |
A4NT is an adversarial sequence‑to‑sequence obfuscator that uses a style classifier loss, a pretrained language model loss, and a cyclic reconstruction… | ||
| GAZELLE: A Low Latency Framework for Secure Neural Network Inference | Chiraag Juvekar | 27m |
Chiraag Juvekar
MIT MTL
Abstract:
The growing popularity of cloud-based machine learning raises natural questions about the privacy guarantees that can be… | ||
| FlowCog: Context-aware Semantics Extraction and Analysis of Information Flow Leaks in Android Apps | Xiang Pan | 23m |
FlowCog extracts flow-level semantics by pairing static data-flow analysis (FlowDroid-based) with a view-dependency walker that finds UI views related to a… | ||
| Sensitive Information Tracking in Commodity IoT | Z. Berkay Celik | 17m |
Presents a concrete tool and results: SainT static taint analyzer translates SmartThings apps into an intermediate representation, identifies four… | ||
| Enabling Refinable Cross-Host Attack Investigation with Efficient Data Flow Tagging and Tracking | Yang Ji | 22m |
RTAG implements cross-host dynamic information flow tracking by combining record-and-replay with system-call provenance and in-packet tag embedding, producing… | ||
| Dependence-Preserving Data Compaction for Scalable Forensic Analysis | Md Nahid Hossain | 23m |
Introduces two graph reductions, full dependence preservation and source dependence preservation, that drop 4.6–19× fewer events while provably preserving… | ||
| nothing matches | ||