Random ramblings of a security nerd

At a high level, Control-Flow Integrity (CFI) restricts the control-flow of an application to valid execution traces.

The last three weeks I've been traveling through China, Hong Kong, and Macau on an interesting security tour thanks to this year's AsiaCCS being held in Xi'an, China.

This year's Oakland (the IEEE Symposium on Security and Privacy, formerly held in Oakland, California) has been a wild ride.

Due to other commitments I only had little time to play during this CTF and when I arrived on Saturday (the 2nd day of the competition) our b01lers were already hacking away and we were hovering somewhere around 100.

For this challenge we were given a corrupted git repository.

We received a PNG file that got somehow corrupted in transit.

We are told that there's a treasure waiting at treasure.ctf.0ops.sjtu.cn so we have to start digging!

Another lazy Sunday (oh well, actually I should be writing papers and grant proposals but we are not talking about that right now) and I'm scrolling through my email when I stumbled upon a "FedEx notice" with your usual "you have not picked up your packag…

Another year, another c3 This year marked my 11th year of congress (and 10th visit with a short hiatus in 2012).

We received a file that looked like it was compressed.

At OSDI'14 we published our paper on [1] where we introduce two new security properties that protect programs against control-flow hijack attacks enabled by memory corruption vulnerabilities.

As part of the weekly CTF meetings we discussed some basic stack-based, heap-based, and format string based exploits.

Do you know this situation where you have some domain specific knowledge about a problem but first level support at a company blocks you from getting to a knowledgeable person?

Writing scientific conference or journal papers is an art by itself.

Breaking Anti-Virus Software: Joxean Koret Joxean gave a great introduction into worst security practices at anti virus companies.

Opening speech: Thomas Lim Thomas gave a great introduction, the conference is as big as ever and attracted a whole bunch of different people.

After a couple of rough months interviewing for academic positions (there's another blog post coming up on this topic, so stay tuned) I headed off for some well deserved vacation time (and with vacation I mean a hacker conference, SyScan 2014 in Singapore…

Program committee (PC) meetings are a strange thing.

A couple of months ago I left the Google cloud and I have been happily using my own services since then.

This year at 30c3 I gave a talk about triggering deep vulnerabilities using symbolic execution.

The same procedure as every year In the last 10 years I visited the chaos communication congress 9 times (at the beginning of my first talk I wrongly stated that it was my 10th visit in 11 years, I stand corrected) and year after year my friends and I had…

Too many accounts Most websites require an account to access even basic functionality and therefore need a dedicated password.

Let me start with a couple of reasons and motivation first Roughly 3 1/2 years ago I switched from a self-hosted service (mainly email, anti-spam, and some squirrel-mail based webmail service) to the Google Apps for your domain cloud.

Why does Gasland have a rating of 7.7 on IMDB?

Roughly two weeks ago I received an email that stated that FreedomPop coverage is now available in my area.

Last weekend Lumi and I traveled to Washington D.C. to explore the capital of the United States.

To relax after some months of hard working and paper grinding Lumi and I decided to head down to Big Sur and Carmel for some days of relaxing, hiking, and nature watching to reload our batteries.

For today's hike we went to Joaquin Miller park in Oakland.

Angel Island is a multi-purpose island that is right in the middle of the bay and surrounded by the three big bridges: Golden Gate bridge, Bay bridge, and Richmond bridge.

Memory corruption (e.g., buffer overflows, random writes, memory allocation bugs, or uncontrolled format strings) is one of the oldest and most exploited problems in computer science.

For those that know us personally it is obvious that Lumi and I are the adventurous types, so when we had the opportunity to explore a dangerous dynamite facility we grabbed it!

For two weekends in a row we went for nice day hikes in Tilden regional park / Wildcat canyon.

A quick and easy 7.2mi (12km) hike in Tilden park with awesome views of the bay area, including San Francisco, the golden gate bridge, Oakland, Emeryville, the bay bridge, silicon valley and much more.

Sangbae Kim, professor in mechanical engineering from MIT visited Berkeley today and gave a great inspiring talk on dynamic locomotion.

Today we went off for another short 'warm-up' hike before the big hiking seasons starts.

A week in Rome: what could be better than sitting all day in a conference room?

On our first hike of the new year we set off for the Golden Gate bridge, Point Bonita lighthouse and beyond.

For a change this post is not about a hike but about a canoe trip that we did on the Russian river.

Muir Woods National Monument is a very special park as you see many redwood groves with huge trees.

Today was a sunny late September lazy Sunday and we just wanted to get out to enjoy the sun and relax a little.

Introduction Deciding to do a PhD is a huge commitment as you are just dedicating a couple of years of your life to a single cause.

Today I had my first day at UC Berkeley in Dawn Song's group and I must say that it was quite an intensive day!

During the long and strenuous hike in Mount Diablo state park my hiking boots broke and fell apart.

When we visited the Black Diamond Mines regional reserve the ranger told us a bit about Mount Diablo.

After some time in the national parks we wanted to explore the national seashore as well.

Our first hike from our new home location was in Black Diamond Mines Regional Reserve.

What is this blog post all about (aka tl;dr)?

Introduction As you might have heard (or not) YouPorn Chat had a huge information leak on February 21st 2012.

Last week we celebrated that special time of the year again.

Summary: Have a vision.