default search action
32nd USENIX Security Symposium 2023: Anaheim, CA, USA
- Joseph A. Calandrino, Carmela Troncoso:
32nd USENIX Security Symposium, USENIX Security 2023, Anaheim, CA, USA, August 9-11, 2023. USENIX Association 2023
Breaking Wireless Protocols
- Ang Li, Jiawei Li, Dianqi Han, Yan Zhang, Tao Li, Ting Zhu, Yanchao Zhang:
PhyAuth: Physical-Layer Message Authentication for ZigBee Networks. 1-18 - Claudio Anliker, Giovanni Camurati, Srdjan Capkun:
Time for Change: How Clocks Break UWB Secure Ranging. 19-36 - Min Shi, Jing Chen, Kun He, Haoran Zhao, Meng Jia, Ruiying Du:
Formal Analysis and Patching of BLE-SC Pairing. 37-52 - Domien Schepers, Aanjhan Ranganathan, Mathy Vanhoef:
Framing Frames: Bypassing Wi-Fi Encryption by Manipulating Transmit Queues. 53-68
Interpersonal Abuse
- Sophie Stephenson, Majed Almansoori, Pardis Emami Naeini, Danny Yuxing Huang, Rahul Chatterjee:
Abuse Vectors: A Framework for Conceptualizing IoT-Enabled Interpersonal Abuse. 69-86 - Rosanna Bellini, Kevin Lee, Megan A. Brown, Jeremy Shaffer, Rasika Bhalerao, Thomas Ristenpart:
The Digital-Safety Risks of Financial Technologies for Survivors of Intimate Partner Violence. 87-104 - Sophie Stephenson, Majed Almansoori, Pardis Emami Naeini, Rahul Chatterjee:
"It's the Equivalent of Feeling Like You're in Jail": Lessons from Firsthand and Secondhand Accounts of IoT-Enabled Intimate Partner Abuse. 105-122 - Rose Ceccio, Sophie Stephenson, Varun Chadha, Danny Yuxing Huang, Rahul Chatterjee:
Sneaky Spy Devices and Defective Detectors: The Ecosystem of Intimate Partner Surveillance with Covert Devices. 123-140
Inferring User Details
- Zhuolin Yang, Yuxin Chen, Zain Sarwar, Hadleigh Schwartz, Ben Y. Zhao, Haitao Zheng:
Towards a General Video-based Keystroke Inference Attack. 141-158 - Carter Slocum, Yicheng Zhang, Nael B. Abu-Ghazaleh, Jiasi Chen:
Going through the motions: AR/VR keylogging from user head motions. 159-174 - Yazhou Tu, Liqun Shan, Md. Imran Hossen, Sara Rampazzi, Kevin R. B. Butler, Xiali Hei:
Auditory Eyesight: Demystifying μs-Precision Keystroke Tracking Attacks on Unconstrained Keyboard Inputs. 175-192 - Noé Zufferey, Mathias Humbert, Romain Tavenard, Kévin Huguenin:
Watch your Watch: Inferring Personality Traits from Wearable Activity Trackers. 193-210
Adversarial ML beyond ML
- Jonathan Prokos, Neil Fendley, Matthew Green, Roei Schuster, Eran Tromer, Tushar M. Jois, Yinzhi Cao:
Squint Hard Enough: Attacking Perceptual Hashing with Adversarial Machine Learning. 211-228 - Xiaojun Xu, Qingying Hao, Zhuolin Yang, Bo Li, David M. Liebovitz, Gang Wang, Carl A. Gunter:
How to Cover up Anomalous Accesses to Electronic Health Records. 229-246 - Xinghui Wu, Shiqing Ma, Chao Shen, Chenhao Lin, Qian Wang, Qi Li, Yuan Rao:
KENKU: Towards Efficient and Stealthy Black-box Adversarial Attacks against ASR Systems. 247-264 - Shimaa Ahmed, Yash Wani, Ali Shahin Shamsabadi, Mohammad Yaghini, Ilia Shumailov, Nicolas Papernot, Kassem Fawaz:
Tubes Among Us: Analog Attack on Automatic Speaker Identification. 265-282
Private Set Operations
- Mingli Wu, Tsz Hon Yuen:
Efficient Unbalanced Private Set Intersection Cardinality and User-friendly Privacy-preserving Contact Tracing. 283-300 - Alexander Bienstock, Sarvar Patel, Joon Young Seo, Kevin Yeo:
Near-Optimal Oblivious Key-Value Stores for Efficient PSI, PSU and Volume-Hiding Multi-Maps. 301-318 - Anrin Chakraborti, Giulia Fanti, Michael K. Reiter:
Distance-Aware Private Set Intersection. 319-336 - Cong Zhang
, Yu Chen, Weiran Liu, Min Zhang, Dongdai Lin:
Linear Private Set Union from Multi-Query Reverse Private Membership Test. 337-354
Logs and Auditing
- Peng Jiang, Ruizhe Huang, Ding Li, Yao Guo, Xiangqun Chen, Jianhai Luan, Yuxin Ren, Xinwei Hu:
Auditing Frameworks Need Resource Isolation: A Systematic Study on the Super Producer Threat to System Auditing and Its Mitigation. 355-372 - Hailun Ding, Juan Zhai
AIRTAG: Towards Automated Attack Investigation by Unsupervised Learning with Log Texts. 373-390 - Varun Gandhi, Sarbartha Banerjee, Aniket Agrawal, Adil Ahmad, Sangho Lee, Marcus Peinado:
Rethinking System Audit Architectures for High Event Coverage and Synchronous Log Availability. 391-408 - Bingyu Shen, Tianyi Shan, Yuanyuan Zhou:
Improving Logging to Reduce Permission Over-Granting Mistakes. 409-426
Fighting the Robots
- Sathvik Prasad, Trevor Dunlap, Alexander J. Ross, Bradley Reaves:
Diving into Robocall Content with SnorCall. 427-444 - Changlai Du, Hexuan Yu, Yang Xiao, Y. Thomas Hou, Angelos D. Keromytis, Wenjing Lou:
UCBlocker: Unwanted Call Blocking Using Anonymous Authentication. 445-462 - Sharbani Pandit, Krishanu Sarker, Roberto Perdisci
Combating Robocalls with Phone Virtual Assistant Mediated Interaction. 463-479 - Minyeop Choi, Gihyuk Ko, Sang Kil Cha:
BotScreen: Trust Everybody, but Cut the Aimbots Yourself. 481-498
Perspectives and Incentives
- Garrett Smith, Tarun Kumar Yadav, Jonathan Dutson, Scott Ruoti, Kent E. Seamons:
"If I could do this, I feel anyone could: " The Design and Evaluation of a Secondary Authentication Factor Manager. 499-515 - Oshrat Ayalon, Dana Turjeman, Elissa M. Redmiles:
Exploring Privacy and Incentives Considerations in Adoption of COVID-19 Contact Tracing Apps. 517-534 - Zixin Wang, Danny Yuxing Huang, Yaxing Yao:
Exploring Tenants' Preferences of Privacy Negotiation in Airbnb. 535-551 - Michele Campobasso, Luca Allodi:
Know Your Cybercriminal: Evaluating Attacker Preferences by Measuring Profile Sales on an Active, Leading Criminal Market for User Impersonation at Scale. 553-570
Traffic Analysis
- Yutao Dong, Qing Li, Kaidong Wu, Ruoyu Li, Dan Zhao, Gareth Tyson, Junkun Peng, Yong Jiang, Shutao Xia, Mingwei Xu:
HorusEye: A Realtime IoT Malicious Traffic Detection Framework using Programmable Switches. 571-588 - Jian Qu, Xiaobo Ma, Jianfeng Li, Xiapu Luo, Lei Xue, Junjie Zhang, Zhenhua Li, Li Feng, Xiaohong Guan:
An Input-Agnostic Hierarchical Deep Learning Framework for Traffic Fingerprinting. 589-606 - Meng Shen, Kexin Ji, Zhenbo Gao, Qi Li, Liehuang Zhu, Ke Xu:
Subverting Website Fingerprinting Defenses with Robust Traffic Representation. 607-624 - Renjie Xie, Jiahao Cao, Enhuan Dong, Mingwei Xu, Kun Sun, Qi Li, Licheng Shen, Menghao Zhang:
Rosetta: Enabling Robust TLS Encrypted Traffic Classification in Diverse Network Environments with TCP-Aware Traffic Augmentation. 625-642
Adversarial Patches and Images
- Mazal Bethany, Andrew Seong, Samuel Henrique Silva, Nicole Beebe, Nishant Vishwamitra, Peyman Najafirad:
Towards Targeted Obfuscation of Adversarial Unsafe Images using Reconstruction and Counterfactual Super Region Attribution Explainability. 643-660 - Wenjun Zhu, Xiaoyu Ji, Yushi Cheng, Shibo Zhang, Wenyuan Xu:
TPatch: A Triggered Physical Adversarial Patch. 661-678 - Shibo Zhang, Yushi Cheng, Wenjun Zhu, Xiaoyu Ji, Wenyuan Xu:
CAPatch: Physical Adversarial Patch against Image Captioning Systems. 679-696 - Guanhong Tao, Shengwei An, Siyuan Cheng, Guangyu Shen, Xiangyu Zhang:
Hard-label Black-box Universal Adversarial Patch Attack. 697-714
Decentralized Finance
- Svetlana Abramova, Rainer Böhme:
Anatomy of a High-Profile Data Breach: Dissecting the Aftermath of a Crypto-Wallet Case. 715-732 - Giulia Scaffino, Lukas Aumayr, Zeta Avarikioti, Matteo Maffei:
Glimpse: On-Demand PoW Light Client with Constant-Size Storage for DeFi. 733-750 - Fieke Miedema, Kelvin Lubbertsen, Verena Schrama, Rolf van Wegberg:
Mixed Signals: Analyzing Ground-Truth Data on the Users and Economics of a Bitcoin Mixing Service. 751-768 - Christof Ferreira Torres, Fiona Willi, Shweta Shinde:
Is Your Wallet Snitching On You? An Analysis on the Privacy Implications of Web3. 769-786
Memory
- Jason Zhijingcheng Yu, Conrad Watt, Aditya Badole, Trevor E. Carlson, Prateek Saxena:
Capstone: A Capability-based Foundation for Trustless Secure Memory Access. 787-804 - Floris Gorter, Enrico Barberis, Raphael Isemann, Erik van der Kouwe, Cristiano Giuffrida, Herbert Bos:
FloatZone: Accelerating Memory Error Detection using the Floating Point Unit. 805-822 - Carter Yagemann, Simon P. Chung, Brendan Saltaformaggio, Wenke Lee:
PUMM: Preventing Use-After-Free Using Execution Unit Partitioning. 823-840 - Xingman Chen, Yinghao Shi, Zheyu Jiang, Yuan Li, Ruoyu Wang, Haixin Duan, Haoyu Wang, Chao Zhang:
MTSan: A Feasible and Practical Memory Sanitizer for Fuzzing COTS Binaries. 841-858
Security in Digital Realities
- Sindhu Reddy Kalathur Gopal, Diksha Shukla, James David Wheelock, Nitesh Saxena:
Hidden Reality: Caution, Your Hand Gesture Inputs in the Immersive Virtual World are Visible to All! 859-876 - Habiba Farrukh, Reham Mohamed, Aniket Nare, Antonio Bianchi, Z. Berkay Celik:
LocIn: Inferring Semantic Location from Spatial Maps in Mixed Reality. 877-894 - Vivek Nair, Wenbo Guo, Justus Mattern, Rui Wang, James F. O'Brien, Louis B. Rosenberg, Dawn Song:
Unique Identification of 50, 000+ Virtual Reality Users from Head & Hand Motion Data. 895-910 - Kaiming Cheng, Jeffery F. Tian, Tadayoshi Kohno, Franziska Roesner:
Exploring User Reactions and Mental Models Towards Perceptual Manipulation Attacks in Mixed Reality. 911-928 - Yoonsang Kim, Sanket Goutam, Amir Rahmati, Arie E. Kaufman:
Erebus: Access Control for Augmented Reality Systems. 929-946
Password Guessing
- Ding Wang, Xuan Shan, Qiying Dong, Yaosheng Shen, Chunfu Jia:
No Single Silver Bullet: Measuring the Accuracy of Password Strength Meters. 947-964 - Ding Wang, Yunkai Zou, Zijian Zhang, Kedong Xiu:
Password Guessing Using Random Forest. 965-982 - Ding Wang, Yunkai Zou, Yuan-an Xiao, Siqi Ma, Xiaofeng Chen:
Pass2Edit: A Multi-Step Generative Model for Guessing Edited Passwords. 983-1000 - Ming Xu, Jitao Yu, Xinyi Zhang, Chuanwang Wang, Shenghao Zhang, Haoqi Wu, Weili Han:
Improving Real-world Password Guessing Attacks via Bi-directional Transformers. 1001-1018 - Mazharul Islam, Marina Sanusi Bohuk, Paul Chung
Araña: Discovering and Characterizing Password Guessing Attacks in Practice. 1019-1036
Privacy Policies, Labels, Etc.
- Hao Cui, Rahmadi Trimananda, Athina Markopoulou, Scott Jordan:
PoliGraph: Automated Privacy Policy Analysis using Knowledge Graphs. 1037-1054 - Wenjun Qiu, David Lie, Lisa M. Austin:
Calpric: Inclusive and Fine-grain Labeling of Privacy Policies with Crowdsourcing and Active Learning. 1055-1072 - Lu Zhou, Chengyongxiao Wei, Tong Zhu, Guoxing Chen, Xiaokuan Zhang, Suguo Du, Hui Cao, Haojin Zhu:
POLICYCOMP: Counterpart Comparison of Privacy Policies Uncovers Overbroad Personal Data Collection Practices. 1073-1090 - Yue Xiao, Zhengyi Li, Yue Qin, Xiaolong Bai, Jiale Guan, Xiaojing Liao, Luyi Xing:
Lalaine: Measuring and Characterizing Non-Compliance of Apple Privacy Labels. 1091-1108 - Rishabh Khandelwal, Asmit Nayak, Hamza Harkous, Kassem Fawaz:
Automated Cookie Notice Analysis and Enforcement. 1109-1126
ML Applications to Malware
- Yizheng Chen, Zhoujie Ding, David A. Wagner:
Continuous Learning for Android Malware Detection. 1127-1144 - Simone Aonzo, Yufei Han, Alessandro Mantovani, Davide Balzarotti:
Humans vs. Machines in Malware Classification. 1145-1162 - Keane Lucas, Samruddhi Pai, Weiran Lin, Lujo Bauer, Michael K. Reiter, Mahmood Sharif:
Adversarial Training for Raw-Binary Malware Classifiers. 1163-1180 - Heng Li, Zhang Cheng, Bang Wu, Liheng Yuan, Cuiying Gao, Wei Yuan, Xiapu Luo:
Black-box Adversarial Example Attack towards FCG Based Android Malware Detection under Incomplete Feature Information. 1181-1198 - Kunal Mukherjee, Joshua Wiedemeier, Tianhao Wang, James Wei, Feng Chen, Muhyun Kim, Murat Kantarcioglu, Kangkook Jee:
Evading Provenance-Based ML Detectors with Adversarial System Actions. 1199-1216
Secure Messaging
- Théophile Wallez, Jonathan Protzenko, Benjamin Beurdouche, Karthikeyan Bhargavan:
TreeSync: Authenticated Group Management for Messaging Layer Security. 1217-1233 - Cas Cremers, Charlie Jacomme, Aurora Naska:
Formal Analysis of Session-Handling in Secure Messaging: Lifting Security from Sessions to Conversations. 1235-1252 - David Balbás, Daniel Collins, Serge Vaudenay:
Cryptographic Administration for Secure Group Messaging. 1253-1270 - Anrin Chakraborti, Darius Suciu, Radu Sion:
Wink: Deniable Secure Messaging. 1271-1288 - Kenneth G. Paterson, Matteo Scarlata
Three Lessons From Threema: Analysis of a Secure Messenger. 1289-1306
x-Fuzz
- Jinyan Xu, Yiyuan Liu, Sirui He, Haoran Lin, Yajin Zhou, Cong Wang:
MorFuzz: Fuzzing Processor via Runtime Instruction Morphing enhanced Synchronizable Co-simulation. 1307-1324 - Yongheng Chen, Rui Zhong, Yupeng Yang, Hong Hu, Dinghao Wu, Wenke Lee:
µFUZZ: Redesign of Parallel Fuzzing using Microservice Architecture. 1325-1342 - Han Zheng, Jiayuan Zhang, Yuhang Huang, Zezhong Ren, He Wang, Chunjie Cao, Yuqing Zhang, Flavio Toffalini, Mathias Payer:
FISHFUZZ: Catch Deeper Bugs by Throwing Larger Nets. 1343-1360 - Chen Chen, Rahul Kande, Nathan Nguyen, Flemming Andersen, Aakash Tyagi, Ahmad-Reza Sadeghi, Jeyavijayan Rajendran:
HyPFuzz: Formal-Assisted Processor Fuzzing. 1361-1378 - Wen Li, Jinyang Ruan, Guangbei Yi, Long Cheng, Xiapu Luo, Haipeng Cai:
PolyFuzz: Holistic Greybox Fuzzing of Multi-Language Systems. 1379-1396
Programs, Code, and Binaries
- Hengkai Ye, Song Liu, Zhechang Zhang, Hong Hu:
VIPER: Spotting Syscall-Guard Variables for Data-Only Attacks. 1397-1414 - Peiwei Hu, Ruigang Liang, Ying Cao, Kai Chen, Runze Zhang:
AURC: Detecting Errors in Program Code and Documentation. 1415-1432 - Salman Ahmed, Hans Liljestrand, Hani Jamjoom, Matthew Hicks, N. Asokan, Danfeng Yao:
Not All Data are Created Equal: Data and Pointer Prioritization for Scalable Protection Against Data-Oriented Attacks. 1433-1450 - Soumyakant Priyadarshan, Huan Nguyen, Rohit Chouhan, R. Sekar:
SAFER: Efficient and Error-Tolerant Binary Instrumentation. 1451-1468 - Hyungseok Kim, Soomin Kim, Junoh Lee, Kangkook Jee, Sang Kil Cha:
Reassembly is Hard: A Reflection on Challenges and Strategies. 1469-1486
IoT Security Expectations and Barriers
- Lorenz Kustosch, Carlos Gañán, Mattis van 't Schip, Michel van Eeten, Simon Parkin:
Measuring Up to (Reasonable) Consumer Expectations: Providing an Empirical Basis for Holding IoT Manufacturers Legally Responsible. 1487-1504 - Pardis Emami Naeini, Janarth Dheenadhayalan, Yuvraj Agarwal, Lorrie Faith Cranor:
Are Consumers Willing to Pay for Security and Privacy of IoT Devices? 1505-1522 - Swaathi Vetrivel, Veerle van Harten, Carlos Hernandez Gañán, Michel van Eeten, Simon Parkin:
Examining Consumer Reviews to Understand Security and Privacy Issues in the Market of Smart Home Devices. 1523-1540 - Nissy Sombatruang, Tristan Caulfield, Ingolf Becker, Akira Fujita, Takahiro Kasama, Koji Nakao, Daisuke Inoue:
Internet Service Providers' and Individuals' Attitudes, Barriers, and Incentives to Secure IoT. 1541-1558 - Haotian Chi, Qiang Zeng, Xiaojiang Du:
Detecting and Handling IoT Interaction Threats in Multi-Platform Multi-Control-Channel Smart Homes. 1559-1576
Differential Privacy
- Chenghong Wang, David Pujol, Kartik Nayak, Ashwin Machanavajjhala:
Private Proof-of-Stake Blockchains using Differentially-Private Stake Distortion. 1577-1594 - Yuchen Yang, Bo Hui, Haolin Yuan, Neil Zhenqiang Gong, Yinzhi Cao:
PrivateFL: Accurate, Differentially Private Federated Learning via Personalized Data Transformation. 1595-1612 - Priyanka Nanayakkara, Mary Anne Smart, Rachel Cummings, Gabriel Kaptchuk, Elissa M. Redmiles:
What Are the Chances? Explaining the Epsilon Parameter in Differential Privacy. 1613-1630 - Milad Nasr, Jamie Hayes, Thomas Steinke, Borja Balle, Florian Tramèr, Matthew Jagielski, Nicholas Carlini, Andreas Terzis:
Tight Auditing of Differentially Private Machine Learning. 1631-1648 - Haiming Wang, Zhikun Zhang, Tianhao Wang, Shibo He, Michael Backes, Jiming Chen, Yang Zhang:
PrivTrace: Differentially Private Trajectory Synthesis by Adaptive Markov Models. 1649-1666
Poisoning
- Yi Zeng, Minzhou Pan, Himanshu Jahagirdar, Ming Jin, Lingjuan Lyu, Ruoxi Jia:
Meta-Sift: How to Sift Out a Clean Subset in the Presence of Data Poisoning? 1667-1684 - Xiangyu Qi, Tinghao Xie, Jiachen T. Wang, Tong Wu, Saeed Mahloujifar, Prateek Mittal:
Towards A Proactive ML Approach for Detecting Backdoor Poison Samples. 1685-1702 - Jinyuan Jia, Yupei Liu, Yuepeng Hu, Neil Zhenqiang Gong:
PORE: Provably Robust Recommender Systems against Data Poisoning Attacks. 1703-1720 - Hamid Mozaffari, Virat Shejwalkar, Amir Houmansadr:
Every Vote Counts: Ranking-Based Training of Federated Learning to Resist Poisoning Attacks. 1721-1738 - Xiaoguang Li, Ninghui Li, Wenhai Sun, Neil Zhenqiang Gong, Hui Li:
Fine-grained Poisoning Attack to Local Differential Privacy Protocols for Mean and Variance Estimation. 1739-1756
Smart Contracts
- Zhuo Zhang, Zhiqiang Lin, Marcelo Morales, Xiangyu Zhang, Kaiyuan Zhang:
Your Exploit is Mine: Instantly Synthesizing Counterattack Smart Contract. 1757-1774 - Tamer Abdelaziz, Aquinas Hobor:
Smart Learning to Find Dumb Contracts. 1775-1792 - Fabio Gritti, Nicola Ruaro, Robert McLaughlin, Priyanka Bose, Dipanjan Das, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna:
Confusum Contractum: Confused Deputy Vulnerabilities in Ethereum Smart Contracts. 1793-1810 - Zhiyuan Sun, Xiapu Luo, Yinqian Zhang:
Panda: Security Analysis of Algorand Smart Contracts. 1811-1828 - William Edward Bodell III, Sajad Meisami, Yue Duan:
Proxy Hunting: Understanding and Characterizing Proxy-based Upgradeable Smart Contracts in Blockchains. 1829-1846
x-Fuzz and Fuzz-x
- Nils Bars, Moritz Schloegel, Tobias Scharnowski, Nico Schiller, Thorsten Holz:
Fuzztruction: Using Fault Injection-based Fuzzing to Leverage Implicit Domain Knowledge. 1847-1864 - Junjie Wang, Zhiyi Zhang, Shuang Liu, Xiaoning Du, Junjie Chen:
FuzzJIT: Oracle-Enhanced Fuzzing for JavaScript Engine JIT Compiler. 1865-1882 - Hui Peng, Zhihao Yao, Ardalan Amiri Sani, Dave Tian, Mathias Payer:
GLeeFuzz: Fuzzing WebGL Through Error Message Guided Mutation. 1883-1899 - Yu-Fu Fu, Jae-Hyuk Lee, Taesoo Kim:
autofz: Automated Fuzzer Composition at Runtime. 1901-1918 - Dawei Wang, Ying Li, Zhiyu Zhang, Kai Chen:
CarpetFuzz: Automatic Program Option Constraint Extraction from Documentation for Fuzzing. 1919-1936
Cache Attacks
- Federico Canale, Tim Güneysu, Gregor Leander, Jan Philipp Thoma, Yosuke Todo, Rei Ueno:
SCARF - A Low-Latency Block Cipher for Secure Cache-Randomization. 1937-1954 - Daniel Katzman, William Kosasih
The Gates of Time: Improving Cache Attacks with Transient Execution. 1955-1972 - Jiyong Yu, Aishani Dutta, Trent Jaeger, David Kohlbrenner, Christopher W. Fletcher:
Synchronization Storage Channels (S2C): Timer-less Cache Side-Channel Attacks on the Apple M1 via Hardware Synchronization Instructions. 1973-1990 - Jan Philipp Thoma
ClepsydraCache - Preventing Cache Attacks with Time-Based Evictions. 1991-2008 - Yuanyuan Yuan, Zhibo Liu, Shuai Wang:
CacheQL: Quantifying and Localizing Cache Side-Channel Vulnerabilities in Production Software. 2009-2026
Authentication
- Yu Chen, Yang Yu, Lidong Zhai:
InfinityGauntlet: Expose Smartphone Fingerprint Authentication to Brute-force Attack. 2027-2041 - Anthony Gavazzi, Ryan Williams, Engin Kirda, Long Lu, Andre King, Andy Davis, Tim Leek:
A Study of Multi-Factor and Risk-Based Authentication Availability. 2043-2060 - Suood Abdulaziz Al-Roomi, Frank Li:
A Large-Scale Measurement of Website Login Policies. 2061-2078 - Conor Gilsenan, Fuzail Shakir, Noura Alomar, Serge Egelman:
Security and Privacy Failures in Popular 2FA Apps. 2079-2096 - Vivek Nair, Dawn Song:
Multi-Factor Key Derivation Function (MFKDF) for Fast, Flexible, Secure, & Practical Key Management. 2097-2114
Private Data Leaks
- Allan Lyons, Julien Gamba, Austin Shawaga, Joel Reardon, Juan Tapiador, Serge Egelman, Narseo Vallina-Rodriguez:
Log: It's Big, It's Heavy, It's Filled with Personal Data! Measuring the Logging of Sensitive Information in the Android Ecosystem. 2115-2132 - Liang Niu, Muhammad Shujaat Mirza, Zayd Maradni, Christina Pöpper:
CodexLeaks: Privacy Leaks from Code Generation Language Models in GitHub Copilot. 2133-2150 - Evangelos Bitsikas, Theodor Schnitzler, Christina Pöpper, Aanjhan Ranganathan:
Freaky Leaky SMS: Extracting User Locations by Analyzing SMS Timings. 2151-2168 - Rachel McAmis, Tadayoshi Kohno:
The Writing on the Wall and 3D Digital Twins: Personal Information in (not so) Private Real Estate. 2169-2186
Generative AI
- Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, Ben Y. Zhao:
Glaze: Protecting Artists from Style Mimicry by Text-to-Image Models. 2187-2204 - Gustavo Sandoval, Hammond Pearce, Teo Nys, Ramesh Karri
Lost at C: A User Study on the Security Implications of Large Language Model Code Assistants. 2205-2222 - Wai Man Si, Michael Backes, Yang Zhang, Ahmed Salem:
Two-in-One: A Model Hijacking Attack Against Text Generation Models. 2223-2240 - Nils Lukas, Florian Kerschbaum:
PTW: Pivotal Tuning Watermarking for Pre-Trained Image Generators. 2241-2258
Security Worker Perspectives
- Daniel W. Woods, Rainer Böhme, Josephine Wolff, Daniel Schwarcz:
Lessons Lost: Incident Response in the Age of Cyber Insurance and Breach Attorneys. 2259-2273 - Omer Akgul, Taha Eghtesad, Amit Elazari, Omprakash Gnawali, Jens Grossklags, Michelle L. Mazurek, Daniel Votipka, Aron Laszka:
Bug Hunters' Perspectives on the Challenges and Benefits of the Bug Bounty Ecosystem. 2275-2291 - Kailani R. Jones, Dalton A. Brucker-Hahn, Bradley Fidler, Alexandru G. Bardas:
Work-From-Home and COVID-19: Trajectories of Endpoint Security Management in a Security Operations Center. 2293-2310 - Jonas Hielscher, Uta Menges, Simon Parkin, Annette Kluge, M. Angela Sasse:
"Employees Who Don't Accept the Time Security Takes Are Not Aware Enough": The CISO View of Human-Centred Security. 2311-2328
Deep Thoughts on Deep Learning
- Jialai Wang, Ziyuan Zhang, Meiqi Wang, Han Qiu, Tianwei Zhang, Qi Li, Zongpeng Li, Tao Wei, Chao Zhang:
Aegis: Mitigating Targeted Bit-flip Attacks against Deep Neural Networks. 2329-2346 - Yifan Yan, Xudong Pan, Mi Zhang, Min Yang:
Rethinking White-Box Watermarks on Deep Learning Models under Neural Structural Obfuscation. 2347-2364 - Zhuo Zhang, Guanhong Tao, Guangyu Shen, Shengwei An, Qiuling Xu, Yingqi Liu, Yapeng Ye, Yaoxuan Wu, Xiangyu Zhang:
PELICAN: Exploiting Backdoors of Naturally Trained Deep Learning Models In Binary Code Analysis. 2365-2382 - Neophytos Christou, Di Jin, Vaggelis Atlidakis, Baishakhi Ray, Vasileios P. Kemerlis:
IvySyn: Automated Vulnerability Discovery in Deep Learning Frameworks. 2383-2400
Smart? Assistants
- Piet De Vaere, Adrian Perrig:
Hey Kimya, Is My Smart Speaker Spying on Me? Taking Control of Sensor Privacy Through Isolation and Amnesia. 2401-2418 - Dilawer Ahmed, Aafaq Sabir, Anupam Das:
Spying through Your Voice Assistants: Realistic Voice Command Fingerprinting. 2419-2436 - Guangke Chen, Yedi Zhang, Zhe Zhao, Fu Song:
QFA2SR: Query-Free Adversarial Transfer Attacks to Speaker Recognition Systems. 2437-2454 - Xinfeng Li, Xiaoyu Ji, Chen Yan, Chaohao Li, Yichen Li, Zhenning Zhang, Wenyuan Xu:
Learning Normality is Enough: A Software-based Mitigation against Inaudible Voice Attacks. 2455-2472 - Youngwook Do, Nivedita Arora, Ali Mirzazadeh, Injoo Moon, Eryue Xu, Zhihan Zhang, Gregory D. Abowd, Sauvik Das:
Powering for Privacy: Improving User Trust in Smart Speaker Microphones with Intentional Powering and Perceptible Assurance. 2473-2490
Security-Adjacent Worker Perspectives
- Lea Gröber, Rafael Mrowczynski, Nimisha Vijay, Daphne A. Muller, Adrian Dabrowski, Katharina Krombholz:
To Cloud or not to Cloud: A Qualitative Study on Self-Hosters' Motivation, Operation, and Security Mindset. 2491-2508 - Sandra Höltervennhoff, Philip Klostermeyer, Noah Wöhler, Yasemin Acar, Sascha Fahl:
"I wouldn't want my unsafe code to run my pacemaker": An Interview Study on the Use, Comprehension, and Perceived Risks of Unsafe Rust. 2509-2525 - Alexander Krause, Jan H. Klemmer, Nicolas Huaman, Dominik Wermke, Yasemin Acar, Sascha Fahl:
Pushed by Accident: A Mixed-Methods Study on Strategies of Handling Secret Information in Source Code Repositories. 2527-2544 - Tanusree Sharma, Kyrie Zhixuan Zhou, Andrew Miller, Yang Wang:
A Mixed-Methods Study of Security Practices of Smart Contract Developers. 2545-2562 - Wentao Guo, Jason Walter, Michelle L. Mazurek:
The Role of Professional Product Reviewers in Evaluating Security and Privacy. 2563-2580
Censorship and Internet Freedom
- Reethika Ramesh, Ram Sundara Raman, Apurva Virkud, Alexandra Dirksen, Armin Huremagic, David Fifield, Dirk Rodenburg, Rod Hynes, Douglas Madory, Roya Ensafi:
Network Responses to Russia's Invasion of Ukraine in 2022: A Cautionary Tale for Internet Freedom. 2581-2598 - Yuzhou Feng, Ruyu Zhai, Radu Sion, Bogdan Carbunar:
A Study of China's Censorship and Its Evasion Through the Lens of Online Gaming. 2599-2616 - Abderrahmen Amich, Birhanu Eshete
DeResistor: Toward Detection-Resistant Probing for Evasion of Internet Censorship. 2617-2633 - Rasmus Dahlberg, Tobias Pulls:
Timeless Timing Attacks and Preload Defenses in Tor's DNS Cache. 2635-2652 - Mingshi Wu, Jackson Sippe, Danesh Sivakumar, Jack Burg, Peter Anderson, Xiaokang Wang, Kevin Bock, Amir Houmansadr, Dave Levin, Eric Wustrow:
How the Great Firewall of China Detects and Blocks Fully Encrypted Traffic. 2653-2670
Machine Learning Backdoors
- Peizhuo Lv, Chang Yue, Ruigang Liang, Yunfei Yang, Shengzhi Zhang, Hualong Ma, Kai Chen:
A Data-free Backdoor Injection Approach in Neural Networks. 2671-2688 - Jianwen Tian, Kefan Qiu, Debin Gao, Zhi Wang, Xiaohui Kuang, Gang Zhao:
Sparsity Brings Vulnerabilities: Exploring New Metrics in Backdoor Attacks. 2689-2706 - Cheng'an Wei, Yeonjoon Lee, Kai Chen, Guozhu Meng, Peizhuo Lv:
Aliasing Backdoor Attacks on Pre-trained Models. 2707-2724 - Minzhou Pan, Yi Zeng, Lingjuan Lyu, Xue Lin, Ruoxi Jia:
ASSET: Robust Backdoor Data Detection Across a Multiplicity of Deep Learning Paradigms. 2725-2742 - Yijie Bai, Yanjiao Chen, Hanlei Zhang, Wenyuan Xu, Haiqin Weng, Dou Goodman:
VILLAIN: Backdoor Attacks Against Vertical Split Learning. 2743-2760
Integrity
- Jinwen Wang, Yujie Wang, Ao Li, Yang Xiao, Ruide Zhang, Wenjing Lou, Y. Thomas Hou, Ning Zhang:
ARI: Attestation of Real-time Mission Execution Integrity. 2761-2778 - Dino Mehmedagic, Mohammad Rahmani Fadiheh, Johannes Müller, Anna Lena Duque Antón, Dominik Stoffel, Wolfgang Kunz:
Design of Access Control Mechanisms in Systems-on-Chip with Formal Integrity Guarantees. 2779-2796 - Lukas Lamster, Martin Unterguggenberger, David Schrammel, Stefan Mangard:
HashTag: Hash-based Integrity Protection for Tagged Architectures. 2797-2814 - Zhiyuan Yu, Yuanhaur Chang, Shixuan Zhai, Nicholas Deily, Tao Ju, XiaoFeng Wang, Uday Jammalamadaka, Ning Zhang:
XCheck: Verifying Integrity of 3D Printed Patient-Specific Devices via Computing Tomography. 2815-2832 - Zechao Cai, Jiaxun Zhu, Wenbo Shen, Yutian Yang, Rui Chang, Yu Wang, Jinku Li, Kui Ren:
Demystifying Pointer Authentication on Apple M1. 2833-2848
Fuzzing Firmware and Drivers
- Ming Yuan, Bodong Zhao, Penghui Li, Jiashuo Liang, Xinhui Han, Xiapu Luo, Chao Zhang:
DDRace: Finding Concurrency UAF Vulnerabilities in Linux Drivers with Directed Fuzzing. 2849-2866 - Cen Zhang, Yuekang Li, Hao Zhou, Xiaohan Zhang, Yaowen Zheng, Xian Zhan, Xiaofei Xie, Xiapu Luo, Xinghua Li, Yang Liu, Sheikh Mahbub Habib:
Automata-Guided Control-Flow-Sensitive Fuzz Driver Generation. 2867-2884 - Tobias Scharnowski, Simon Wörner, Felix Buchmann, Nils Bars, Moritz Schloegel, Thorsten Holz:
Hoedur: Embedded Firmware Fuzzing using Multi-Stream Inputs. 2885-2902 - Lukas Seidel
Forming Faster Firmware Fuzzers. 2903-2920 - Jisoo Jang, Minsuk Kang, Dokyung Song:
ReUSB: Replay-Guided USB Driver Fuzzing. 2921-2938
Vehicles and Security
- Qifan Xiao, Xudong Pan, Yifan Lu, Mi Zhang, Jiarun Dai, Min Yang:
Exorcising "Wraith": Protecting LiDAR-based Object Detector in Automated Driving System from Appearing Attacks. 2939-2956 - Ruoyu Song, Muslum Ozgur Ozmen, Hyungsub Kim, Raymond Muller, Z. Berkay Celik, Antonio Bianchi:
Discovering Adversarial Driving Maneuvers against Autonomous Vehicles. 2957-2974 - Zekun Cai, Aiping Xiong:
Understand Users' Privacy Perception and Decision of V2X Communication in Connected Autonomous Vehicles. 2975-2992 - Yulong Cao, S. Hrushikesh Bhupathiraju, Pirouz Naghavi, Takeshi Sugawara, Z. Morley Mao, Sara Rampazzi:
You Can't See Me: Physical Removal Attacks on LiDAR-based Autonomous Vehicles Driving Frameworks. 2993-3010 - Hyungsub Kim, Muslum Ozgur Ozmen, Z. Berkay Celik, Antonio Bianchi, Dongyan Xu:
PatchVerif: Discovering Faulty Patches in Robotic Vehicles. 3011-3028
Verifying Users
- Wei-Zhu Yeoh, Michal Kepkowski, Gunnar Heide, Dali Kaafar, Lucjan Hanzlik:
Fast IDentity Online with Anonymous Credentials (FIDO-AC). 3029-3046 - Julia Hesse, Nitin Singh, Alessandro Sorniotti:
How to Bind Anonymous Credentials to Humans. 3047-3064 - David A. Basin, Patrick Schaller, Jorge Toro-Pozo:
Inducing Authentication Failures to Bypass Credit Card PINs. 3065-3079 - Andrew Searles, Yoshimichi Nakatsuka, Ercan Ozturk, Andrew Paverd, Gene Tsudik, Ai Enkoji:
An Empirical Study & Evaluation of Modern CAPTCHAs. 3081-3097 - Madelyne Xiao, Mona Wang, Anunay Kulshrestha, Jonathan R. Mayer:
Account Verification on Social Media: User Perceptions and Paid Enrollment. 3099-3116
DNS Security
- Alexandra Nisenoff, Ranya Sharma, Nick Feamster:
User Awareness and Behaviors Concerning Encrypted DNS Settings in Web Browsers. 3117-3133 - Elsa Turcios Rodriguez, Radu Anghel, Simon Parkin, Michel van Eeten, Carlos Gañán:
Two Sides of the Shield: Understanding Protective DNS adoption factors. 3135-3152 - Xiang Li, Chaoyi Lu, Baojun Liu, Qifan Zhang, Zhou Li
The Maginot Line: Attacking the Boundary of DNS Caching Protection. 3153-3170 - Alden Hilton, Casey T. Deccio, Jacob Davis:
Fourteen Years in the Life: A Root Server's Perspective on DNS Resolver Security. 3171-3186 - Yehuda Afek, Anat Bremler-Barr, Shani Stajnrod:
NRDelegationAttack: Complexity DDoS attack on DNS Recursive Resolvers. 3187-3204
Graphs and Security
- Cheng-Long Wang
Inductive Graph Unlearning. 3205-3222 - Sina Sajadmanesh, Ali Shahin Shamsabadi, Aurélien Bellet, Daniel Gatica-Perez:
GAP: Differentially Private Graph Neural Networks with Aggregation Perturbation. 3223-3240 - Quan Yuan, Zhikun Zhang, Linkang Du, Min Chen, Peng Cheng, Mingyang Sun:
PrivGraph: Differentially Private Graph Data Publication by Exploiting Community Information. 3241-3258 - Zhaohan Xi, Tianyu Du, Changjiang Li, Ren Pang, Shouling Ji, Xiapu Luo, Xusheng Xiao, Fenglong Ma, Ting Wang:
On the Security Risks of Knowledge Graph Reasoning. 3259-3276 - Hailun Ding, Juan Zhai
The Case for Learned Provenance Graph Storage Systems. 3277-3294
Ethereum Security
- Robert McLaughlin, Christopher Kruegel, Giovanni Vigna:
A Large Scale Study of the Ethereum Arbitrage Ecosystem. 3295-3312 - Sangdon Park, Osbert Bastani, Taesoo Kim:
ACon2: Adaptive Conformal Consensus for Provable Blockchain Oracles. 3313-3330 - Massimiliano Taverna, Kenneth G. Paterson:
Snapping Snap Sync: Practical Attacks on Go Ethereum Synchronising Nodes. 3331-3348 - Federico Cernera, Massimo La Morgia, Alessandro Mei, Francesco Sassi:
Token Spammers, Rug Pulls, and Sniper Bots: An Analysis of the Ecosystem of Tokens in Ethereum and in the Binance Smart Chain (BNB). 3349-3366 - Wansen Wang, Wenchao Huang, Zhaoyi Meng, Yan Xiong, Fuyou Miao, Xianjin Fang, Caichang Tu, Renjie Ji:
Automated Inference on Financial Security of Ethereum Smart Contracts. 3367-3383
Supply Chains and Third-Party Code
- Yafei Wu, Cong Sun, Dongrui Zeng, Gang Tan, Siqi Ma, Peicheng Wang:
LibScan: Towards More Precise Third-Party Library Identification for Android Applications. 3385-3402 - Xueqiang Wang, Yifan Zhang, XiaoFeng Wang, Yan Jia, Luyi Xing:
Union under Duress: Understanding Hazards of Duplicate Resource Mismediation in Android Software Supply Chain. 3403-3420 - Binbin Zhao, Shouling Ji, Xuhong Zhang, Yuan Tian, Qinying Wang
UVSCAN: Detecting Third-Party Component Usage Violations in IoT Firmware. 3421-3438 - Shradha Neupane, Grant Holmes, Elizabeth Wyss, Drew Davidson, Lorenzo De Carli:
Beyond Typosquatting: An In-depth Look at Package Confusion. 3439-3456 - Abdullah AlHamdan, Cristian-Alexandru Staicu:
SandDriller: A Fully-Automated Approach for Testing Language-Based JavaScript Sandboxes. 3457-3474
Cellular Networks
- Daniel Klischies, Moritz Schloegel, Tobias Scharnowski, Mikhail Bogodukhov, David Rupprecht, Veelasha Moonsamy:
Instructions Unclear: Undefined Behaviour in Cellular Network Specifications. 3475-3492 - Gabriel K. Gegenhuber, Wilfried Mayer, Edgar R. Weippl, Adrian Dabrowski:
MobileAtlas: Geographically Decoupled Measurements in Cellular Networks for Security and Privacy Research. 3493-3510 - Tao Ni, Guohao Lan, Jia Wang, Qingchuan Zhao, Weitao Xu:
Eavesdropping Mobile App Activity via Radio-Frequency Energy Harvesting. 3511-3528 - Yi Chen, Di Tang, Yepeng Yao, Mingming Zha, XiaoFeng Wang, Xiaozhong Liu, Haixu Tang, Baoxu Liu:
Sherlock on Specs: Building LTE Conformance Tests through Automated Reasoning. 3529-3545 - Eunsoo Kim, Min Woo Baek, CheolJun Park, Dongkwan Kim, Yongdae Kim, Insu Yun:
BASECOMP: A Comparative Analysis for Integrity Protection in Cellular Baseband Software. 3547-3563
Usability and User Perspectives
- Dañiel Gerhardt, Alexander Ponticello, Adrian Dabrowski, Katharina Krombholz:
Investigating Verification Behavior and Perceptions of Visual Digital Certificates. 3565-3582 - Jonah Stegman, Patrick J. Trottier, Caroline Hillier, Hassan Khan, Mohammad Mannan:
"My Privacy for their Security": Employees' Privacy Perspectives and Expectations when using Enterprise Security Software. 3583-3600 - Alaa Daffalla, Marina Sanusi Bohuk, Nicola Dell, Rosanna Bellini, Thomas Ristenpart:
Account Security Interfaces: Important, Unintuitive, and Untrustworthy. 3601-3618 - Alexandra Nisenoff, Arthur Borem, Madison Pickering, Grant Nakanishi, Maya Thumpasery, Blase Ur:
Defining "Broken": User Experiences and Remediation Tactics When Ad-Blocking or Tracking-Protection Tools Break a Website's User Experience. 3619-3636 - Tarun Kumar Yadav, Devashish Gosain, Kent E. Seamons:
Cryptographic Deniability: A Multi-perspective Study of User Perceptions and Expectations. 3637-3654
Entomology
- Jianhao Xu, Kangjie Lu, Zhengjie Du, Zhu Ding, Linke Li, Qiushi Wu, Mathias Payer, Bing Mao:
Silent Bugs Matter: A Study of Compiler-Introduced Security Bugs. 3655-3672 - Gertjan Franken, Tom van Goethem, Lieven Desmet, Wouter Joosen:
A Bug's Life: Analyzing the Lifecycle and Mitigation Process of Content Security Policy Bugs. 3673-3690 - Yudi Zhao, Yuan Zhang, Min Yang:
Remote Code Execution from SSTI in the Sandbox: Automatically Detecting and Exploiting Template Escape Bugs. 3691-3708 - Miaoqian Lin, Kai Chen, Yang Xiao:
Detecting API Post-Handling Bugs Using Code and Description in Patches. 3709-3726 - Yuandao Cai, Peisen Yao, Chengfeng Ye, Charles Zhang:
Place Your Locks Well: Understanding and Detecting Lock Misuse Bugs. 3727-3744
Adversarial Examples
- Ryan Sheatsley, Blaine Hoak, Eric Pauley, Patrick D. McDaniel:
The Space of Adversarial Strategies. 3745-3761 - Jaron Mink, Harjot Kaur, Juliane Schmüser, Sascha Fahl, Yasemin Acar:
"Security is not my field, I'm a stats guy": A Qualitative Root Cause Analysis of Barriers to Adversarial Machine Learning Defenses in Industry. 3763-3780 - Aishan Liu, Jun Guo, Jiakai Wang, Siyuan Liang, Renshuai Tao, Wenbo Zhou, Cong Liu, Xianglong Liu, Dacheng Tao:
X-Adv: Physical Adversarial Object Attacks against X-ray Prohibited Item Detection. 3781-3798 - Zhiyuan Yu, Yuanhaur Chang, Ning Zhang, Chaowei Xiao:
SMACK: Semantically Meaningful Adversarial Audio Attack. 3799-3816 - Kevin Eykholt, Taesung Lee, Douglas Lee Schales, Jiyong Jang, Ian M. Molloy, Masha Zorin:
URET: Universal Robustness Evaluation Toolkit (for Evasion). 3817-3833
Private Record Access
- Simone Colombo, Kirill Nikitin, Henry Corrigan-Gibbs, David J. Wu, Bryan Ford:
Authenticated private information retrieval. 3835-3851 - Sarvar Patel, Joon Young Seo, Kevin Yeo:
Don't be Dense: Efficient Keyword PIR for Sparse Databases. 3853-3870 - Brett Hemenway Falk, Rafail Ostrovsky, Matan Shtepel, Jacob Zhang:
GigaDORAM: Breaking the Billion Address Barrier. 3871-3888 - Alexandra Henzinger, Matthew M. Hong, Henry Corrigan-Gibbs, Sarah Meiklejohn, Vinod Vaikuntanathan:
One Server for the Price of Two: Simple and Fast Single-Server Private Information Retrieval. 3889-3905 - Adithya Vadapalli, Ryan Henry, Ian Goldberg:
Duoram: A Bandwidth-Efficient Distributed ORAM for 2- and 3-Party Computation. 3907-3924
It's All Fun and Games Until...
- Chaoshun Zuo, Chao Wang, Zhiqiang Lin:
A Peek into the Metaverse: Detecting 3D Model Clones in Mobile Games. 3925-3942 - Wenbo Guo, Xian Wu, Lun Wang, Xinyu Xing, Dawn Song:
PATROL: Provable Defense against Adversarial Policy in Two-player Games. 3943-3960 - Kaihua Qin, Stefanos Chaliasos, Liyi Zhou, Benjamin Livshits, Dawn Song, Arthur Gervais:
The Blockchain Imitation Game. 3961-3978 - Yicheng Zhang, Carter Slocum, Jiasi Chen, Nael B. Abu-Ghazaleh:
It's all in your head(set): Side-channel attacks on AR/VR systems. 3979-3996 - Haohuang Wen, Zhiqiang Lin:
Egg Hunt in Tesla Infotainment: A First Look at Reverse Engineering of Qt Binaries. 3997-4014
Enclaves and Serverless Computing
- Shixuan Zhao, Pinshen Xu, Guoxing Chen, Mengya Zhang, Yinqian Zhang, Zhiqiang Lin:
Reusable Enclaves for Confidential Serverless Computing. 4015-4032 - Afonso Tinoco
EnigMap: External-Memory Oblivious Map for Secure Enclaves. 4033-4050 - Scott Constable, Jo Van Bulck, Xiang Cheng, Yuan Xiao, Cedric Xing, Ilya Alexandrovich, Taesoo Kim, Frank Piessens, Mona Vij, Mark Silberstein:
AEX-Notify: Thwarting Precise Single-Stepping Attacks through Interrupt Awareness for Intel SGX Enclaves. 4051-4068 - Sanchuan Chen, Zhiqiang Lin, Yinqian Zhang:
Controlled Data Races in Enclaves: Attacks and Detection. 4069-4086 - Deepak Sirone Jegan, Liang Wang, Siddhant Bhagat, Michael M. Swift:
Guarding Serverless Applications with Kalium. 4087-4104
Email and Phishing
- Lina Brunken, Annalina Buckmann, Jonas Hielscher, M. Angela Sasse:
"To Do This Properly, You Need More Resources": The Hidden Costs of Introducing Simulated Phishing Campaigns. 4105-4122 - Md. Ishtiaq Ashiq, Weitong Li, Tobias Fiebig, Taejoong Chung:
You've Got Report: Measurement and Security Implications of DMARC Reporting. 4123-4137 - Ruofan Liu, Yun Lin, Yifan Zhang, Penn Han Lee, Jin Song Dong:
Knowledge Expansion and Counterfactual Interaction for Reference-Based Phishing Detection. 4139-4156 - Iskander Sánchez-Rola, Leyla Bilge, Davide Balzarotti, Armin Buescher, Petros Efstathopoulos:
Rods with Laser Beams: Understanding Browser Fingerprinting on Phishing Pages. 4157-4173 - Fabian Ising, Damian Poddebniak, Tobias Kappert, Christoph Saatjohann, Sebastian Schinzel:
Content-Type: multipart/oracle - Tapping into Format Oracles in Email End-to-End Encryption. 4175-4192
OSes and Security
- Zicheng Wang, Yueqi Chen, Qingkai Zeng:
PET: Prevent Discovered Errors from Being Triggered in the Linux Kernel. 4193-4210 - Guoren Li, Hang Zhang, Jinmeng Zhou, Wenbo Shen, Yulei Sui, Zhiyun Qian:
A Hybrid Alias Analysis and Its Application to Global Variable Protection in the Linux Kernel. 4211-4228 - Ruipeng Wang, Kaixiang Chen, Chao Zhang, Zulie Pan, Qianyu Li, Siliang Qin, Shenglin Xu, Min Zhang, Yang Li:
AlphaEXP: An Expert System for Identifying Security-Sensitive Kernel Objects. 4229-4246 - Yuhang Wu, Zhenpeng Lin, Yueqi Chen, Dang K. Le, Dongliang Mu, Xinyu Xing:
Mitigating Security Risks in Linux with KLAUS: A Method for Evaluating Patch Correctness. 4247-4264 - Yuxing Zhang, Xiaogang Zhu, Daojing He, Minhui Xue, Shouling Ji, Mohammad Sayad Haghighi, Sheng Wen, Zhiniang Peng:
Detecting Union Type Confusion in Component Object Model. 4265-4281
Intrusion Detection
- Julien Piet, Aashish Sharma, Vern Paxson, David A. Wagner:
Network Detection of Interactive SSH Impostors Using Deep Learning. 4283-4300 - Phillip Rieger, Marco Chilese, Reham Mohamed, Markus Miettinen, Hossein Fereidooni, Ahmad-Reza Sadeghi:
ARGUS: Context-Based Detection of Stealthy IoT Infiltration Attacks. 4301-4318 - HyungBin Seo, MyungKeun Yoon:
Generative Intrusion Detection and Prevention on Data Stream. 4319-4335 - Feng Wei, Hongda Li, Ziming Zhao, Hongxin Hu:
xNIDS: Explaining Deep Learning-based Network Intrusion Detection Systems for Active Intrusion Responses. 4337-4354 - Fan Yang, Jiacen Xu, Chunlin Xiong, Zhou Li
PROGRAPHER: An Anomaly Detection System based on Provenance Graph Embedding. 4355-4372
Privacy Preserving Crypto Blocks
- Changchang Ding, Yan Huang:
Dubhe: Succinct Zero-Knowledge Proofs for Standard AES and related Applications. 4373-4390 - Matteo Campanelli, Mathias Hall-Andersen, Simon Holmgaard Kamp:
Curve Trees: Practical and Transparent Zero-Knowledge Accumulators. 4391-4408 - Weijie Wang, Annie Ulichney, Charalampos Papamanthou:
BalanceProofs: Maintainable Vector Commitments with Fast Aggregation. 4409-4426 - Sanjam Garg
zkSaaS: Zero-Knowledge SNARKs as a Service. 4427-4444 - Alex Luoyuan Xiong, Binyi Chen, Zhenfei Zhang, Benedikt Bünz, Ben Fisch, Fernando Krell, Philippe Camacho:
VeriZexe: Decentralized Private Computation with Universal Setup. 4445-4462
Warm and Fuzzing
- Jiwon Kim, Benjamin E. Ujcich, Dave Tian:
Intender: Fuzzing Intent-Based Networking with Intent-State Transition Guidance. 4463-4480 - Zhengxiong Luo, Junze Yu, Feilong Zuo, Jianzhong Liu, Yu Jiang, Ting Chen, Abhik Roychoudhury, Jiaguang Sun:
Bleem: Packet Sequence Oriented Fuzzing for Protocol Implementations. 4481-4498 - Bin Zhang, Jiongyi Chen, Runhao Li, Chao Feng, Ruilin Li, Chaojing Tang:
Automated Exploitable Heap Layout Generation for Heap Overflows Through Manipulation Distance-Guided Fuzzing. 4499-4515 - Chenyang Lyu, Jiacheng Xu, Shouling Ji, Xuhong Zhang, Qinying Wang
MINER: A Hybrid Data-Driven Approach for REST API Fuzzing. 4517-4534 - Philipp Görz, Björn Mathis, Keno Hassler, Emre Güler, Thorsten Holz, Andreas Zeller, Rahul Gopinath:
Systematic Assessment of Fuzzers using Mutation Analysis. 4535-4552
Remote Attacks
- Kong Huang, Yutong Zhou, Ke Zhang, Jiacen Xu, Jiongyi Chen, Di Tang, Kehuan Zhang:
HOMESPY: The Invisible Sniffer of Infrared Remote Control of Smart TVs. 4553-4570 - Lanqing Yang, Xinqi Chen, Xiangyong Jian, Leping Yang, Yijie Li, Qianfei Ren, Yi-Chao Chen, Guangtao Xue, Xiaoyu Ji:
Remote Attacks on Speech Recognition Systems Using Sound from Power Supply. 4571-4588 - Qi Xia, Qian Chen, Shouhuai Xu:
Near-Ultrasound Inaudible Trojan (Nuit): Exploiting Your Speaker to Attack Your Microphone. 4589-4606 - Xing Han, Yuheng Zhang, Xue Zhang, Zeyuan Chen, Mingzhe Wang, Yiwei Zhang, Siqi Ma, Yu Yu, Elisa Bertino, Juanru Li:
Medusa Attack: Exploring Security Hazards of In-App QR Code Scanning. 4607-4624
Understanding Communities, Part 1
- Jessica McClearn, Rikke Bjerg Jensen, Reem Talhouk:
Othered, Silenced and Scapegoated: Understanding the Situated Security of Marginalised Populations in Lebanon. 4625-4642 - Wael S. Albayaydh, Ivan Flechais:
Examining Power Dynamics and User Privacy in Smart Technology Use Among Jordanian Households. 4643-4659 - Yuhang Zhao, Yaxing Yao, Jiaru Fu, Nihan Zhou:
"If sighted people know, I should be able to know: " Privacy Perceptions of Bystanders with Visual Impairments around Camera-based Technology. 4661-4678 - Elaine Lau, Zachary Peterson:
A Research Framework and Initial Study of Browser Security for the Visually Impaired. 4679-4696
Keeping Computations Confidential
- Yongwoo Lee, Seonyoung Cheon, Dongkwan Kim, Dongyoon Lee, Hanjun Kim:
ELASM: Error-Latency-Aware Scale Management for Fully Homomorphic Encryption. 4697-4714 - Alexander Viand, Patrick Jattke, Miro Haller, Anwar Hithnawi:
HECO: Fully Homomorphic Encryption Compiler. 4715-4732 - Hongbo Chen, Haobin Hiroki Chen, Mingshen Sun, Kang Li, Zhaofeng Chen, XiaoFeng Wang:
A Verified Confidential Computing as a Service Framework for Privacy Preservation. 4733-4750 - Adi Akavia, Neta Oren, Boaz Sapir, Margarita Vald:
CSHER: A System for Compact Storage with HE-Retrieval. 4751-4768
Towards Robust Learning
- Yuanyuan Yuan, Shuai Wang, Zhendong Su:
Precise and Generalized Robustness Certification for Neural Networks. 4769-4786 - Jiawei Zhang, Zhongzhu Chen, Huan Zhang, Chaowei Xiao, Bo Li:
DiffSmooth: Certifiably Robust Learning via Diffusion Models and Local Smoothing. 4787-4804 - James Bell, Adrià Gascón, Tancrède Lepoint, Baiyu Li, Sarah Meiklejohn, Mariana Raykova, Cathie Yun:
ACORN: Input Validation for Secure Aggregation. 4805-4822 - Ian Chang, Katerina Sotiraki
HOLMES: Efficient Distribution Testing for Secure Collaborative Learning. 4823-4840
Network Cryptographic Protocols
- Tomas Hlavacek, Haya Schulmann, Niklas Vogel, Michael Waidner:
Keep Your Friends Close, but Your Routeservers Closer: Insights into RPKI Validation in the Internet. 4841-4858 - Nurullah Erinola, Marcel Maehren, Robert Merget, Juraj Somorovsky, Jörg Schwenk:
Exploring the Unknown DTLS Universe: Analysis of the DTLS Server Ecosystem on the Internet. 4859-4876 - Sven Hebrok, Simon Nachtigall, Marcel Maehren, Nurullah Erinola, Robert Merget, Juraj Somorovsky, Jörg Schwenk:
We Really Need to Talk About Session Tickets: A Large-Scale Analysis of Cryptographic Dangers with TLS Session Tickets. 4877-4894 - Birk Blechschmidt, Ben Stock:
Extended Hell(o): A Comprehensive Large-Scale Study on Email Confidentiality and Integrity Mechanisms in the Wild. 4895-4912
Warmer and Fuzzers
- Leo Stone, Rishi Ranjan, Stefan Nagy, Matthew Hicks:
No Linux, No Problem: Fast and Correct Windows Binary Fuzzing via Target-embedded Snapshotting. 4913-4929 - Tae Eun Kim, Jaeseung Choi, Kihong Heo, Sang Kil Cha:
DAFL: Directed Grey-box Fuzzing guided by Data Dependency. 4931-4948 - Zu-Ming Jiang, Jia-Ju Bai, Zhendong Su:
DynSQL: Stateful Fuzzing for Database Management Systems with Complex and Valid SQL Query Generation. 4949-4965 - Ji Shi, Zhun Wang, Zhiyao Feng, Yang Lan, Shisong Qin, Wei You, Wei Zou, Mathias Payer, Chao Zhang:
AIFORE: Smart Fuzzing Based on Automatic Input Format Reverse Engineering. 4967-4984
Kernel Analysis
- Mingi Cho, Dohyeon An, Hoyong Jin, Taekyoung Kwon:
BoKASAN: Binary-only Kernel Address Sanitizer for Effective Kernel Fuzzing. 4985-5002 - Marius Fleischer, Dipanjan Das, Priyanka Bose, Weiheng Bai, Kangjie Lu, Mathias Payer, Christopher Kruegel, Giovanni Vigna:
ACTOR: Action-Guided Kernel Fuzzing. 5003-5020 - Ioannis Angelakopoulos, Gianluca Stringhini, Manuel Egele:
FirmSolo: Enabling dynamic analysis of binary Linux-based IoT kernel modules. 5021-5038 - Tingting Yin, Zicong Gao, Zhenghang Xiao, Zheyu Ma, Min Zheng, Chao Zhang:
KextFuzz: Fuzzing macOS Kernel EXTensions on Apple Silicon via Exploiting Mitigations. 5039-5054 - Jakob Koschel, Pietro Borrello, Daniele Cono D'Elia, Herbert Bos, Cristiano Giuffrida:
Uncontained: Uncovering Container Confusion in the Linux Kernel. 5055-5072
It's Academic
- Victoria Zhong, Susan E. McGregor, Rachel Greenstadt:
"I'm going to trust this until it burns me" Parents' Privacy Concerns and Delegation of Trust in K-8 Educational Technology. 5073-5090 - David G. Balash, Elena Korkes, Miles Grant, Adam J. Aviv, Rahel A. Fainchtein, Micah Sherr:
Educators' Perspectives of Using (or Not Using) Online Exam Proctoring. 5091-5108 - Thorsten Eisenhofer, Erwin Quiring, Jonas Möller, Doreen Riepel, Thorsten Holz, Konrad Rieck:
No more Reviewer #2: Subverting Automatic Paper-Reviewer Assignment using Adversarial Learning. 5109-5126 - Alexandra Nisenoff, Maximilian Golla, Miranda Wei, Juliette Hainline, Hayley Szymanek, Annika Braun, Annika Hildebrandt, Blair Christensen, David Langenberg, Blase Ur:
A Two-Decade Retrospective Analysis of a University's Vulnerability to Attacks Exploiting Reused Passwords. 5127-5144 - Tadayoshi Kohno, Yasemin Acar, Wulf Loh:
Ethical Frameworks and Computer Security Trolley Problems: Foundations for Conversations. 5145-5162
De-anonymization and Re-identification
- Jiangyi Deng, Yanjiao Chen, Yinan Zhong, Qianhao Miao, Xueluan Gong, Wenyuan Xu:
Catch You and I Can: Revealing Source Voiceprint Against Voice Conversion. 5163-5180 - Jiangyi Deng, Fei Teng, Yanjiao Chen, Xiaofu Chen, Zhaohui Wang, Wenyuan Xu:
V-Cloak: Intelligibility-, Naturalness- & Timbre-Preserving Real-Time Voice Anonymization. 5181-5198 - Dominic Deuber, Michael Keuchen, Nicolas Christin:
Assessing Anonymity Techniques Employed in German Court Decisions: A De-Anonymization Experiment. 5199-5216 - Yili Ren, Yichao Wang, Sheng Tan, Yingying Chen, Jie Yang:
Person Re-identification in 3D Space: A WiFi Vision-based Approach. 5217-5234 - Karola Marky, Shaun Alexander Macdonald, Yasmeen Abdrabou, Mohamed Khamis:
In the Quest to Protect Users from Side-Channel Attacks - A User-Centred Design Space to Mitigate Thermal Attacks on Public Payment Terminals. 5235-5252
Thieves in the House
- Nicholas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramèr, Borja Balle, Daphne Ippolito, Eric Wallace:
Extracting Training Data from Diffusion Models. 5253-5270 - Xinben Gao, Lan Zhang:
PCAT: Functionality and Data Stealing from Split Learning by Pseudo-Client Attack. 5271-5288 - Boyang Zhang, Xinlei He, Yun Shen, Tianhao Wang, Yang Zhang:
A Plot is Worth a Thousand Words: Model Information Stealing Attacks via Scientific Plots. 5289-5306 - Athanasios Avgetidis, Omar Alrawi, Kevin Valakuzhy, Charles Lever, Paul Burbage, Angelos D. Keromytis, Fabian Monrose, Manos Antonakakis:
Beyond The Gates: An Empirical Analysis of HTTP-Managed Password Stealers and Operators. 5307-5324 - Xin Liu, Wei Wang, Guanqun Song, Ting Zhu:
LightThief: Your Optical Communication Information is Stolen behind the Wall. 5325-5339
Distributed Secure Computations
- Haibin Zhang, Sisi Duan, Boxin Zhao, Liehuang Zhu:
WaterBear: Practical Asynchronous BFT Matching Security Guarantees of Partially Synchronous BFT. 5341-5357 - Sourav Das, Zhuolun Xiang, Lefteris Kokoris-Kogias, Ling Ren:
Practical Asynchronous High-threshold Distributed Key Generation and Distributed Polynomial Sampling. 5359-5376 - Yun Li, Yufei Duan, Zhicong Huang, Cheng Hong, Chao Zhang, Yifan Song:
Efficient 3PC for Binary Circuits with Application to Maliciously-Secure DNN Inference. 5377-5394 - Muhammad Faisal, Jerry Zhang, John Liagouris
TVA: A multi-party computation system for secure and expressive time series analytics. 5395-5412 - Thomas Yurek, Zhuolun Xiang, Yu Xia, Andrew Miller:
Long Live The Honey Badger: Robust Asynchronous DPSS and its Applications. 5413-5430
Mobile Security and Privacy
- Daniel Hugenroth, Alastair R. Beresford:
Powering Privacy: On the Energy Demand and Feasibility of Anonymity Networks on Smartphones. 5431-5448 - Brian Tang, Kang G. Shin:
Eye-Shield: Real-Time Protection of Mobile Device Screen Information from Shoulder Surfing. 5449-5466 - Simon Koch, Benjamin Altpeter, Martin Johns:
The OK Is Not Enough: A Large Scale Study of Consent Dialogs in Smartphone Applications. 5467-5484 - Shuai Li, Zhemin Yang, Guangliang Yang, Hange Zhang, Nan Hua, Yurui Huang, Min Yang:
Notice the Imposter! A Study on User Tag Spoofing Attack in Mobile Apps. 5485-5501 - Rui Li, Wenrui Diao, Shishuai Yang, Xiangyu Liu, Shanqing Guo, Kehuan Zhang:
Lost in Conversion: Exploit Data Structure Conversion with Attribute Loss to Break Android Systems. 5503-5520
Web Security
- Mikhail Shcherbakov, Musard Balliu, Cristian-Alexandru Staicu:
Silent Spring: Prototype Pollution Leads to Remote Code Execution in Node.js. 5521-5538 - Marco Squarcina, Pedro Adão, Lorenzo Veronese, Matteo Maffei:
Cookie Crumbles: Breaking and Fixing Web Session Integrity. 5539-5556 - Rasoul Jahanshahi, Babak Amin Azad, Nick Nikiforakis, Manuel Egele:
Minimalist: Semi-automated Debloating of PHP Web Applications through Static Analysis. 5557-5573 - Babak Amin Azad, Rasoul Jahanshahi, Chris Tsoukaladelis, Manuel Egele, Nick Nikiforakis:
AnimateDead: Debloating Web Applications Using Concolic Execution. 5575-5591 - Gelei Deng, Zhiyi Zhang, Yuekang Li, Yi Liu, Tianwei Zhang, Yang Liu, Guo Yu, Dongjin Wang:
NAUTILUS: Automated RESTful API Vulnerability Detection. 5593-5609
Understanding Communities, Part 2
- Kovila P. L. Coopamootoo, Magdalene Ng:
"Un-Equal Online Safety?" A Gender Analysis of Security and Privacy Protection Advice and Behaviour Patterns. 5611-5628 - Patrawat Samermit, Anna Turner, Patrick Gage Kelley, Tara Matthews, Vanessia Wu, Sunny Consolvo, Kurt Thomas:
"Millions of people are watching you": Understanding the Digital-Safety Needs and Practices of Creators. 5629-5645 - Alan F. Luo, Noel Warford, Samuel Dooley, Rachel Greenstadt, Michelle L. Mazurek, Nora McDonald:
How Library IT Staff Navigate Privacy and Security Challenges and Responsibilities. 5647-5664 - Muhammad Ali, Angelica Goetzen, Alan Mislove, Elissa M. Redmiles, Piotr Sapiezynski:
Problematic Advertising and its Disparate Exposure on Facebook. 5665-5682 - Savino Dambra, Leyla Bilge, Platon Kotzias, Yun Shen, Juan Caballero:
One Size Does not Fit All: Quantifying the Risk of Malicious App Encounters for Different Android User Profiles. 5683-5700
Routing and VPNs
- Grace H. Cimaszewski, Henry Birge-Lee, Liang Wang, Jennifer Rexford, Prateek Mittal:
How Effective is Multiple-Vantage-Point Domain Control Validation? 5701-5718 - Nian Xue, Yashaswi Malla, Zihang Xia, Christina Pöpper, Mathy Vanhoef:
Bypassing Tunnels: Leaking VPN Client Traffic by Abusing Routing Tables. 5719-5736 - Ka Lok Wu, Man Hong Hue, Ngai Man Poon, Kin Man Leung, Wai Yin Po, Kin Ting Wong, Sze Ho Hui, Sze Yiu Chau:
Back to School: On the (In)Security of Academic VPNs. 5737-5754 - Cyrill Krähenbühl, Marc Wyss, David A. Basin, Vincent Lenders, Adrian Perrig, Martin Strohmeier:
FABRID: Flexible Attestation-Based Routing for Inter-Domain Networks. 5755-5772 - Reethika Ramesh, Anjali Vyas, Roya Ensafi:
"All of them claim to be the best": Multi-perspective study of VPN users and VPN providers. 5773-5789
Embedded Systems and Firmware
- Hui Jun Tay, Kyle Zeng, Jayakrishna Menon Vadayath, Arvind S. Raj, Audrey Dutcher, Tejesh Reddy, Wil Gibbs, Zion Leonahenahe Basque, Fangzhou Dong, Zack Smith, Adam Doupé, Tiffany Bao, Yan Shoshitaishvili, Ruoyu Wang:
Greenhouse: Single-Service Rehosting of Linux-Based Firmware Binaries in User-Space Emulation. 5791-5808 - Zhaokun Han, Mohammed Shayan, Aneesh Dixit, Mustafa M. Shihab, Yiorgos Makris, Jeyavijayan Rajendran:
FuncTeller: How Well Does eFPGA Hide Functionality? 5809-5826 - Adam Caulfield, Norrathep Rattanavipanon, Ivan De Oliveira Nunes:
ACFA: Secure Runtime Auditing & Guaranteed Device Healing via Active Control Flow Attestation. 5827-5844 - Kyungtae Kim, Sungwoo Kim, Kevin R. B. Butler, Antonio Bianchi, Rick Kennell, Dave Tian:
Fuzz The Power: Dual-role State Guided Black-box Fuzzing for USB Power Delivery. 5845-5861 - Robert Dumitru, Daniel Genkin, Andrew Wabnitz, Yuval Yarom:
The Impostor Among US(B): Off-Path Injection Attacks on USB Communications. 5863-5880
Attacks on Cryptography
- Charlie Jacomme, Elise Klein, Steve Kremer, Maïwenn Racouchot:
A comprehensive, formal and automated analysis of the EDHOC protocol. 5881-5898 - Vincent Cheval, Cas Cremers, Alexander Dax, Lucca Hirschi, Charlie Jacomme, Steve Kremer:
Hash Gone Bad: Automated discovery of protocol attacks that exploit hash function weaknesses. 5899-5916 - Olivier Blazy, Ioana Boureanu, Pascal Lafourcade, Cristina Onete
How fast do you heal? A taxonomy for post-compromise security in secure-channel establishment. 5917-5934 - Cas Cremers, Alexander Dax, Charlie Jacomme, Mang Zhao:
Automated Analysis of Protocols that use Authenticated Encryption: How Subtle AEAD Differences can impact Protocol Security. 5935-5952 - Xianglong Zhang, Wei Wang, Peng Xu, Laurence T. Yang, Kaitai Liang:
High Recovery with Fewer Injections: Practical Binary Volumetric Injection Attacks against Dynamic Searchable Encryption. 5953-5970
Cloud Insecurity
- Yi He, Roland Guo, Yunlong Xing, Xijia Che, Kun Sun, Zhuotao Liu, Ke Xu, Qi Li:
Cross Container Attacks: The Bewildered eBPF on Clouds. 5971-5988 - Eric Pauley, Paul Barford, Patrick D. McDaniel:
DScope: A Cloud-Native Internet Telescope. 5989-6006 - Xueqiang Wang, Yuqiong Sun, Susanta Nanda, XiaoFeng Wang:
Credit Karma: Understanding Security Implications of Exposed Cloud Services through Automated Capability Inference. 6007-6024 - Ilia Shevrin, Oded Margalit:
Detecting Multi-Step IAM Attacks in AWS Environments via Model Checking. 6025-6042 - Hongyi Liu, Jiarong Xing, Yibo Huang, Danyang Zhuo, Srinivas Devadas, Ang Chen:
Remote Direct Memory Introspection. 6043-6060
More Web and Mobile Security
- Parjanya Vyas, Asim Waheed, Yousra Aafer, N. Asokan:
Auditing Framework APIs via Inferred App-side Security Specifications. 6061-6077 - Feras Al Kassar, Luca Compagna, Davide Balzarotti:
WHIP: Improving Static Vulnerability Detection in Web Application by Forcing tools to Collaborate. 6079-6096 - Salim Al Wahaibi, Myles Foley, Sergio Maffeis:
SQIRL: Grey-Box Detection of SQL Injection Vulnerabilities Using Reinforcement Learning. 6097-6114 - Mingxuan Yao, Jonathan Fuller, Ranjita Pai Kasturi, Saumya Agarwal, Amit Kumar Sikder, Brendan Saltaformaggio:
Hiding in Plain Sight: An Empirical Study of Web Application Abuse in Malware. 6115-6132 - Cristian-Alexandru Staicu, Sazzadur Rahaman, Ágnes Kiss, Michael Backes:
Bilingual Problems: Studying the Security Risks Incurred by Native Extensions in Scripting Languages. 6133-6150
Networks and Security
- Jonghoon Kwon, Jeonggyu Song, Junbeom Hur, Adrian Perrig:
Did the Shark Eat the Watchdog in the NTP Pool? Deceiving the NTP Pool's Monitoring System. 6151-6166 - Moshe Kol, Amit Klein, Yossi Gilad:
Device Tracking via Linux's New TCP Source Port Selection Algorithm. 6167-6183 - Run Guo, Jianjun Chen, Yihang Wang, Keran Mu, Baojun Liu, Xiang Li, Chao Zhang, Haixin Duan, Jianping Wu:
Temporal CDN-Convex Lens: A CDN-Assisted Practical Pulsing DDoS Attack. 6185-6202 - Guangmeng Zhou, Zhuotao Liu, Chuanpu Fu, Qi Li, Ke Xu:
An Efficient Design of Intelligent Network Data Plane. 6203-6220 - Hammas Bin Tanveer, Rachee Singh, Paul Pearce, Rishab Nithyanand:
Glowing in the Dark: Uncovering IPv6 Address Discovery and Scanning Strategies in the Wild. 6221-6237
Arming and Disarming ARM
- Xhani Marvin Saß, Richard Mitev, Ahmad-Reza Sadeghi:
Oops..! I Glitched It Again! How to Multi-Glitch the Glitching-Protections on ARM TrustZone-M. 6239-6256 - Yiming Zhang, Yuxin Hu, Zhenyu Ning, Fengwei Zhang, Xiapu Luo, Haoyang Huang, Shoumeng Yan
SHELTER: Extending Arm CCA with Isolation in User Space. 6257-6274 - Hritvik Taneja, Jason Kim, Jie Jeff Xu, Stephan van Schaik, Daniel Genkin, Yuval Yarom:
Hot Pixels: Frequency, Power, and Temperature Attacks on GPUs and Arm SoCs. 6275-6292 - Jesse De Meulemeester, Antoon Purnal, Lennert Wouters, Arthur Beckers, Ingrid Verbauwhede:
SpectrEM: Exploiting Electromagnetic Emanations During Transient Execution. 6293-6310 - Luca Di Bartolomeo, Hossein Moghaddas, Mathias Payer:
ARMore: Pushing Love Back Into Binaries. 6311-6328
More ML Attacks and Defenses
- Deevashwer Rathee, Anwesh Bhattacharya, Divya Gupta, Rahul Sharma, Dawn Song:
Secure Floating-Point Training. 6329-6346 - Qi Liu, Jieming Yin, Wujie Wen, Chengmo Yang, Shi Sha:
NeuroPots: Realtime Proactive Defense against Bit-Flip Attacks in Neural Networks. 6347-6364 - Viktor Valadi, Xinchi Qiu, Pedro Porto Buarque de Gusmão, Nicholas D. Lane, Mina Alibeigi:
FedVal: Different good or different bad in federated learning. 6365-6380 - Kai Yue, Richeng Jin, Chau-Wai Wong, Dror Baron, Huaiyu Dai:
Gradient Obfuscation Gives a False Sense of Security in Federated Learning. 6381-6398 - Chong Fu, Xuhong Zhang, Shouling Ji, Ting Wang, Peng Lin, Yanghe Feng, Jianwei Yin:
FreeEagle: Detecting Complex Neural Trojans in Data-Free Cases. 6399-6416
Cryptography for Privacy
- Antigoni Polychroniadou, Gilad Asharov, Benjamin E. Diamond, Tucker Balch, Hans Buehler, Richard Hua, Suwen Gu, Greg Gimler, Manuela Veloso:
Prime Match: A Privacy-Preserving Inventory Matching System. 6417-6434 - Wen-jie Lu, Zhicong Huang, Qizhi Zhang, Yuchen Wang, Cheng Hong:
Squirrel: A Scalable Secure Two-Party Computation Framework for Training Gradient Boosting Decision Tree. 6435-6451 - Alessandro Chiesa, Ryan Lehmkuhl, Pratyush Mishra, Yinuo Zhang:
Eos: Efficient Private Delegation of zkSNARK Provers. 6453-6469 - Thomas Haines, Rajeev Goré, Mukesh Tiwari:
Machine-checking Multi-Round Proofs of Shuffle: Terelius-Wikstrom and Bayer-Groth. 6471-6488 - Daniël Reijsbergen, Aung Maw, Zheng Yang, Tien Tuan Anh Dinh, Jianying Zhou:
TAP: Transparent and Privacy-Preserving Data Services. 6489-6506
Vulnerabilities and Threat Detection
- Nicholas Boucher, Ross Anderson:
Trojan Source: Invisible Vulnerabilities. 6507-6524 - Santiago Cuéllar, Bill Harris, James Parker, Stuart Pernsteiner, Eran Tromer:
Cheesecloth: Zero-Knowledge Proofs of Real World Vulnerabilities. 6525-6540 - Seunghoon Woo, Eunjin Choi, Heejo Lee, Hakjoo Oh:
V1SCAN: Discovering 1-day Vulnerabilities in Reused C/C++ Open-source Software Components Using Code Classification Techniques. 6541-6556 - Yisroel Mirsky, George Macon, Michael D. Brown, Carter Yagemann, Matthew Pruett, Evan Downing, J. Sukarno Mertoguno, Wenke Lee:
VulChecker: Graph-based Vulnerability Localization in Source Code. 6557-6574 - Feng Dong, Liu Wang, Xu Nie, Fei Shao, Haoyu Wang, Ding Li, Xiapu Luo, Xusheng Xiao:
DISTDET: A Cost-Effective Distributed Cyber Threat Detection System. 6575-6592
Automated Analysis of Deployed Systems
- Kevin Morio
Automated Security Analysis of Exposure Notification Systems. 6593-6610 - Cas Cremers, Alexander Dax, Aurora Naska:
Formal Analysis of SPDM: Security Protocol and Data Model version 1.2. 6611-6628 - Chao Wang, Yue Zhang, Zhiqiang Lin:
One Size Does Not Fit All: Uncovering and Exploiting Cross Platform Discrepant APIs in WeChat. 6629-6646 - Willy R. Vasquez, Stephen Checkoway, Hovav Shacham:
The Most Dangerous Codec in the World: Finding and Exploiting Vulnerabilities in H.264 Decoders. 6647-6664 - Yuhong Nan, Xueqiang Wang, Luyi Xing, Xiaojing Liao, Ruoyu Wu, Jianliang Wu, Yifan Zhang, XiaoFeng Wang:
Are You Spying on Me? Large-Scale Analysis on IoT Data Exposure through Companion Apps. 6665-6682
Manipulation, Influence, and Elections
- Ruben Recabarren, Bogdan Carbunar, Nestor Hernandez, Ashfaq Ali Shafin:
Strategies and Vulnerabilities of Participants in Venezuelan Influence Operations. 6683-6700 - Zheng Yang, Joey Allen, Matthew Landen, Roberto Perdisci
TRIDENT: Towards Detecting and Mitigating Web-based Social Engineering Attacks. 6701-6718 - Sahar Abdelnabi, Mario Fritz:
Fact-Saboteurs: A Taxonomy of Evidence Manipulation Attacks against Fact-Verification Systems. 6719-6736 - Alexandre Debant, Lucca Hirschi:
Reversing, Breaking, and Fixing the French Legislative Election E-Voting Protocol. 6737-6752 - Oliver Broadrick, Poorvi L. Vora, Filip Zagórski:
PROVIDENCE: a Flexible Round-by-Round Risk-Limiting Audit. 6753-6770
Side Channel Attacks
- Zixuan Wang, Mohammadkazem Taram, Daniel Moghimi, Steven Swanson, Dean M. Tullsen, Jishen Zhao:
NVLeak: Off-Chip Side-Channel Attacks via Non-Volatile Memory Systems. 6771-6788 - Jan Wichelmann, Anna Pätschke
Cipherfix: Mitigating Ciphertext Side-Channel Attacks in Software. 6789-6806 - Sihang Liu, Suraaj Kanniwadi, Martin Schwarzl, Andreas Kogler, Daniel Gruss, Samira Manabi Khan:
Side-Channel Attacks on Optane Persistent Memory. 6807-6824 - Yoochan Lee, Jinhan Kwak, Junesoo Kang, Yuseok Jeon, Byoungyoung Lee:
Pspray: Timing Side-Channel based Linux Kernel Heap Exploitation Technique. 6825-6842 - Sen Deng, Mengyuan Li, Yining Tang, Shuai Wang, Shoumeng Yan
CipherH: Automated Detection of Ciphertext Side-channel Vulnerabilities in Cryptographic Implementations. 6843-6860
Transportation and Infrastructure
- Prashant Hari Narayan Rajput, Constantine Doumanidis, Michail Maniatakos:
ICSPatch: Automated Vulnerability Localization and Non-Intrusive Hotpatching in Industrial Control Systems using Data Dependence Graphs. 6861-6876 - Alexander Marder, Zesen Zhang, Ricky K. P. Mok, Ramakrishna Padmanabhan, Bradley Huffaker, Matthew Luckie, Alberto Dainotti
Access Denied: Assessing Physical Risks to Internet Access Networks. 6877-6892 - Khaled Serag, Rohit Bhatia, Akram Faqih, Muslum Ozgur Ozmen, Vireshwar Kumar, Z. Berkay Celik, Dongyan Xu:
ZBCAN: A Zero-Byte CAN Defense System. 6893-6910 - Jiwoo Shin, Hyunghoon Kim, Seyoung Lee, Wonsuk Choi, Dong Hoon Lee, Hyo Jin Jo:
RIDAS: Real-time identification of attack sources on controller area networks. 6911-6928 - Yanmao Man, Raymond Muller, Ming Li, Z. Berkay Celik, Ryan M. Gerdes:
That Person Moves Like A Car: Misclassification Attack Detection for Autonomous Systems Using Spatiotemporal Consistency. 6929-6946
Language-Based Security
- Inyoung Bang, Martin Kayondo, Hyungon Moon, Yunheung Paek:
TRust: A Compilation Framework for In-process Isolation to Protect Safe Rust against Untrusted Code. 6947-6964 - Komail Dharsee, John Criswell:
Jinn: Hijacking Safe Programs with Trojans. 6965-6982 - Siddharth Muralee, Igibek Koishybayev, Aleksandr Nahapetyan, Greg Tystahl, Bradley Reaves, Antonio Bianchi, William Enck, Alexandros Kapravelos, Aravind Machiry:
ARGUS: A Framework for Staged Static Taint Analysis of GitHub Workflows and Actions. 6983-7000 - Maximilian Zinkus, Yinzhi Cao, Matthew D. Green:
McFIL: Model Counting Functionality-Inherent Leakage. 7001-7018 - Qingkai Shi, Xiangzhe Xu, Xiangyu Zhang:
Extracting Protocol Format as State Machine via Controlled Static Loop Analysis. 7019-7036
Browsers
- Matthias Gierlings, Marcus Brinkmann, Jörg Schwenk:
Isolated and Exhausted: Attacking Operating Systems via Site Isolation in the Browser. 7037-7054 - Young Min Kim, Byoungyoung Lee:
Extending a Hand to Attackers: Browser Privilege Escalation Attacks via Extensions. 7055-7071 - Harun Oz, Ahmet Aris, Abbas Acar, Güliz Seray Tuncay, Leonardo Babun, A. Selcuk Uluagac:
RøB: Ransomware over Modern Web Browsers. 7073-7090 - Peter Snyder, Soroush Karami, Arthur Edelstein, Benjamin Livshits, Hamed Haddadi:
Pool-Party: Exploiting Browser Resource Pools for Web Tracking. 7091-7105 - Andrew Kwong, Walter Wang, Jason Kim, Jonathan Berger, Daniel Genkin, Eyal Ronen, Hovav Shacham, Riad S. Wahby, Yuval Yarom:
Checking Passwords on Leaky Computers: A Side Channel Analysis of Chrome's Password Leak Detect Protocol. 7107-7124
Speculation Doesn't Pay
- Zhiyuan Zhang
Ultimate SLH: Taking Speculative Load Hardening to the Next Level. 7125-7142 - Jana Hofmann, Emanuele Vannacci, Cédric Fournet, Boris Köpf, Oleksii Oleksenko:
Speculation at Fault: Modeling and Testing Microarchitectural Leakage of CPU Exceptions. 7143-7160 - Lesly-Ann Daniel, Marton Bognar, Job Noorman, Sébastien Bardin, Tamara Rezk, Frank Piessens:
ProSpeCT: Provably Secure Speculation for the Constant-Time Policy. 7161-7178 - Daniel Moghimi:
Title Redacted Due to Vulnerability Embargo. 7179-7193
Facing the Facts
- Min Chen, Zhikun Zhang, Tianhao Wang, Michael Backes, Yang Zhang:
FACE-AUDITOR: Data Auditing in Facial Recognition Systems. 7195-7212 - Zheng Li, Ning Yu, Ahmed Salem, Michael Backes, Mario Fritz, Yang Zhang:
UnGANable: Defending Against GAN-based Face Manipulation. 7213-7230 - Harrison Rosenberg, Brian Tang, Kassem Fawaz, Somesh Jha:
Fairness Properties of Face Recognition and Obfuscation Systems. 7231-7248 - Qinhong Jiang, Xiaoyu Ji, Chen Yan, Zhixin Xie, Haina Lou, Wenyuan Xu:
GlitchHiker: Uncovering Vulnerabilities of Image Signal Transmission with IEMI. 7249-7266
More Hardware Side Channels
- Ruiyi Zhang, Taehyun Kim, Daniel Weber, Michael Schwarz:
(M)WAIT for It: Bridging the Gap between Microarchitectural and Architectural Side Channels. 7267-7284 - Andreas Kogler, Jonas Juffinger, Lukas Giner, Lukas Gerlach, Martin Schwarzl, Michael Schwarz, Daniel Gruss, Stefan Mangard:
Collide+Power: Leaking Inaccessible Data with Software-based Power Side Channels. 7285-7302 - Daniël Trujillo, Johannes Wikner, Kaveh Razavi:
Inception: Exposing New Attack Surfaces with Training in Transient Execution. 7303-7320 - Zhiyuan Zhang
BunnyHop: Exploiting the Instruction Prefetcher. 7321-7337
Deeper Thoughts on Deep Learning
- Junzhe Wang, Matthew Sharp, Chuxiong Wu, Qiang Zeng, Lannan Luo:
Can a Deep Learning Model for One Architecture Be Used for Others? Retargeted-Architecture Binary Code Analysis. 7339-7356 - Zhibo Liu, Yuanyuan Yuan, Shuai Wang, Xiaofei Xie, Lei Ma:
Decompiling x86 Deep Neural Network Executables. 7357-7374 - Jiahao Yu, Wenbo Guo, Qi Qin, Gang Wang, Ting Wang, Xinyu Xing:
AIRS: Explanation for Deep Reinforcement Learning based Security Applications. 7375-7392 - Zizhuang Deng, Guozhu Meng, Kai Chen, Tong Liu, Lu Xiang, Chunyang Chen:
Differential Testing of Cross Deep Learning Framework APIs: Revealing Inconsistencies and Vulnerabilities. 7393-7410
Attacks on Deployed Cryptosystems
- Simon Rohlmann, Vladislav Mladenov, Christian Mainka, Daniel Hirschberger, Jörg Schwenk:
Every Signature is Broken: On the Insecurity of Microsoft Office's OOXML Signatures. 7411-7428 - Elias Heftrig, Haya Schulmann, Michael Waidner:
Downgrading DNSSEC: How to Exploit Crypto Agility for Hijacking Signed Zones. 7429-7444 - Zichen Gui, Kenneth G. Paterson, Tianxin Tang:
Security Analysis of MongoDB Queryable Encryption. 7445-7462 - Carlo Meijer, Wouter Bokslag, Jos Wetzels:
All cops are broadcasting: TETRA under scrutiny. 7463-7479
Attacking, Defending, and Analyzing
- Binlin Cheng, Erika A. Leal, Haotian Zhang, Jiang Ming:
On the Feasibility of Malware Unpacking via Hardware-assisted Loop Profiling. 7481-7498 - Bingyu Shen, Tianyi Shan, Yuanyuan Zhou:
Multiview: Finding Blind Spots in Access-Deny Issues Diagnosis. 7499-7516 - Jietao Xiao, Nanzi Yang, Wenbo Shen, Jinku Li, Xin Guo, Zhiqiang Dong, Fei Xie, Jianfeng Ma:
Attacks are Forwarded: Breaking the Isolation of MicroVM-based Containers Through Operation Forwarding. 7517-7534 - Hieu Le, Salma Elmalaki, Athina Markopoulou, Zubair Shafiq:
AutoFR: Automated Filter Rule Generation for Adblocking. 7535-7552
manage site settings
To protect your privacy, all features that rely on external API calls from your browser are turned off by default. You need to opt-in for them to become active. All settings here will be stored as cookies with your web browser. For more information see our F.A.Q.
last updated on 2024-12-26 00:58 CET by the dblp team
all metadata released as open data under CC0 1.0 license
see also: Terms of Use | Privacy Policy | Imprint
dblp was originally created in 1993 at:
since 2018, dblp has been operated and maintained by:
the dblp computer science bibliography is funded and supported by: