Random ramblings of a security nerd

x402 is a rising payment protocol that enables micropayments for web services.

As we move to memory safe language, pointer arithmetic no longer is the main source of bugs, instead API misuse becomes a key issue.

Scripting languages are an essential part of many software environments.

Trackers like Apple's FindMy devices have seen an incredible boom throughout the last few years and are used for a variety of use-cases such as tracking lost luggage, stolen bikes, or simply finding one's lost keys.

Arbitrary file overwrite vulnerabilities are, unfortunately, quite common in Android apps.

Fuzzing has become the dominant dynamic testing approach to find bugs in software.

Bug discovery has long been a key concern in the field of software security.

What a great time at the IEEE Symposium on Security and Privacy (informally called Oakland) in San Francisco.

Android runs sensitive applications in the so-called "secure world".

In the last 3-4 months, AI models have made an immense jump in exploitation capabilities.

Fuzzing faces a key challenge: after running for an extensive time, coverage plateaus and will no longer increase despite extensive mutations.

Another year, another CCC.

Android has become a diverse, multi-faceted, and complex ecosystem.

Just a few weeks ago, Chao Zhang invited me to a workshop in AI security at Tsinghua University in Beijing.

Android is a complex platform with diverse, concurrently running services.

Android is a complex platform with diverse, concurrently running services.

The Summer Research Institute (SuRI) is a premier venue to discuss recent research results.

What a great time at the NDSS Symposium in San Diego.

The C++ language combines a massive potential for raw power with the massive risk of type and memory safety violations.

JavaScript engines face a dilemma: on one end, they need to be extremely efficient as they are processing millions of lines of JavaScript code, dynamically translating complex programs into efficient code.

Sanitizers serve as the primary bug detection Oracle during automated testing.

Hypervisors power not just the cloud but are becoming a commodity in mobile phones and desktops as well.

Are you tired of publishing SPAM?

Another year, another CCC.

2024 was an active year for the HexHive research group, marked by tireless efforts to enhance the security of various complex systems.

Niklaus Wirth, known for his work on programming languages and systems, died on January 1st, 2024 (ETH Zurich).

After a three-year hiatus due to the pandemic, the Chaos Communication Congress is finally back at an onsite venue.

In 2018, when I moved from Purdue University in the US to EPFL in Switzerland, I had the opportunity to apply for an ERC H2020 starting grant in computer science.

Due to the risk of "cyber threats", many universities are switching to second factor authentication to log into their VPNs.

Every December a lot of prospective students reach out to faculty regarding PhD programs.

Yesterday we concluded the NDSS20 PC meeting.

While traveling through Europe, I logged into my Expedia.com account and something odd happened: instead of being logged in, the Expedia system decided to redirect me to Expedia.ch and created a new account.

Installing printers can be a pain.

Software contains bugs and some bugs are exploitable.

Side channel attacks such as Spectre or Meltdown allow data leakage from an unwilling process.

On one hand, GPUs expose broad functionality for graphics and machine learning workloads, on the other hand, this functionality may be exploited due to large amounts of unvetted code, complex functionality, and the information gap between user-space appli…

With the rise of strong control-flow defenses such as Control-Flow Integrity (CFI), attackers will increasingly resort to data-only attacks that can be equally powerful.

This post started out of the need to provide a little more clarification after a long and heated discussions on Twitter (initial discussion and follow up) about the origins of Control-Flow Integrity (CFI), the contributions of academia, and the precision,…

Assuming you have given everything to write the best and most beautiful paper you can ever create, it is obvious that the reviewers must see your points and therefore write you a favorable review with a recommendation of strong accept.

After serious advertising of the NSF TTP program at several conferences throughout last year, I've decided to submit to the NSF TTP program last fall.

Program Committee (PC) meetings are this mysterious event where the fate of our research projects is decided based on a review of our paper submission.

Just like every year, this year's NDSS was mid February in sunny (but not too warm) San Diego.

This year at CSET yours truly had the pleasure to organize a round table on rigor in experimentation with Geoff Voelker, Micah Sherr, and Adam Doupé as panelists.

As part of ESSoS ‘17 we have organized a joint ESSoS/DIMVA panel on exploit mitigations, discussing the past, present, and future of mitigations.

Just a couple of days after Oakland '17 I attended my next information security conference.

Every year, the Oakland conference is one of the highlights of security research.

This was my second AsiaCCS.

pdfmaker (75 points) The first challenge I tried was pdfmaker.

According to the description, hxp provides us with a brainfuck (BF) execution service where we can send BF programs over netcat and execute them.

AMD recently announced the new Secure Encrypted Virtualization (SEV) extension that intends to protect virtual machines against compromised hypervisors/Virtual Machine Monitors (VMMs).