\n\n \n\n \n\n \n \n\n \n\n \n \n\n \n\n \n

\n generated by\n \n $\"bibbase.org\"\n$ \n \n

\n \n\n

\n\n

\n \n Group by\n \n \n
- \n Year\n
- \n Author\n
- \n Type\n
- \n Keyword\n
- \n Downloads\n
\n
\n \n \n \n \n
- \n \n Expand/Collapse All\n \n
- \n \n Download BibTeX\n \n
- \n \n RSS Feed\n \n
\n

\n\n\n

\n\n Excellent! Next you can\n create a new website with this list, or\n embed it in an existing web page by copying & pasting\n any of the following snippets.\n\n

\n JavaScript\n (easiest)\n

\n            <script src=\"https://bibbase.org/show?bib=https%3A%2F%2Fdownload.vusec.net%2Fpapers%2Fzotero.php%3Ftag%3Dproj_intersect%26full%3D%26format%3Dbibtex%26sort%3Ddate&theme=default&jsonp=1&showSearch=1&owner=none&filter=keywords:type_paper,&jsonp=1\"></script>\n

\n\n PHP\n

\n            <?php\n            $contents = file_get_contents(\"https://bibbase.org/show?bib=https%3A%2F%2Fdownload.vusec.net%2Fpapers%2Fzotero.php%3Ftag%3Dproj_intersect%26full%3D%26format%3Dbibtex%26sort%3Ddate&theme=default&jsonp=1&showSearch=1&owner=none&filter=keywords:type_paper,\");\n            print_r($contents);\n            ?>\n

\n\n iFrame\n (not recommended)\n

\n            <iframe src=\"https://bibbase.org/show?bib=https%3A%2F%2Fdownload.vusec.net%2Fpapers%2Fzotero.php%3Ftag%3Dproj_intersect%26full%3D%26format%3Dbibtex%26sort%3Ddate&theme=default&jsonp=1&showSearch=1&owner=none&filter=keywords:type_paper,\"></iframe>\n

\n\n

\n For more details see the documention.\n

\n\n

\n\n This is a preview! To use this list on your own web site\n or create a new web site from it,\n create a free account. The file will be added\n and you will be able to edit it in the File Manager.\n We will show you instructions once you've created your account.\n

\n\n

To the site owner:

\n\n

Action required! Mendeley is changing its\n API. In order to keep using Mendeley with BibBase past April\n 14th, you need to:\n

renew the authorization for BibBase on Mendeley, and
update the BibBase URL\n in your page the same way you did when you initially set up\n this page.\n

\n\n

\n \n \n Fix it now\n

\n\n

\n\n\n

\n \n \n

\n \n 2024\n \n \n (7)\n \n \n

\n \n \n

\n \n\n \n \n \n \n \n \n InSpectre Gadget: Inspecting the Residual Attack Surface of Cross-privilege Spectre v2.\n \n \n \n \n\n\n \n Wiebing, S.; de Faveri Tron, A.; Bos, H.; and Giuffrida, C.\n\n\n \n\n\n\n In USENIX Security, August 2024. \n \n\n\n\n
\n\n\n\n \n \n $\"InSpectre$ Paper\n \n \n \n $\"InSpectre$ Web\n \n \n \n $\"InSpectre$ Code\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 118 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{wiebing_inspectre_2024,\n\ttitle = {{InSpectre} {Gadget}: {Inspecting} the {Residual} {Attack} {Surface} of {Cross}-privilege {Spectre} v2},\n\turl = {Paper=https://download.vusec.net/papers/inspectre_sec24.pdf Web=https://vusec.net/projects/native-bhi Code=https://github.com/vusec/inspectre-gadget},\n\tbooktitle = {{USENIX} {Security}},\n\tauthor = {Wiebing, Sander and de Faveri Tron, Alvise and Bos, Herbert and Giuffrida, Cristiano},\n\tmonth = aug,\n\tyear = {2024},\n\tkeywords = {class\\_sidechannels, proj\\_allocamelus, proj\\_intersect, proj\\_rescale, type\\_ae, type\\_conf, type\\_cve\\_assigned, type\\_paper, type\\_tier1, type\\_top},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n Practical Data-Only Attack Generation.\n \n \n \n \n\n\n \n Johannesmeyer, B.; Slowinska, A.; Bos, H.; and Giuffrida, C.\n\n\n \n\n\n\n In USENIX Security, August 2024. \n \n\n\n\n
\n\n\n\n \n \n $\"Practical$ Paper\n \n \n \n $\"Practical$ Code\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 52 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{johannesmeyer_practical_2024,\n\ttitle = {Practical {Data}-{Only} {Attack} {Generation}},\n\turl = {Paper=https://download.vusec.net/papers/einstein_sec24.pdf Code=https://github.com/vusec/einstein},\n\tbooktitle = {{USENIX} {Security}},\n\tauthor = {Johannesmeyer, Brian and Slowinska, Asia and Bos, Herbert and Giuffrida, Cristiano},\n\tmonth = aug,\n\tyear = {2024},\n\tkeywords = {class\\_binary, proj\\_intersect, proj\\_theseus, type\\_ae, type\\_conf, type\\_paper, type\\_tier1, type\\_top},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n GhostRace: Exploiting and Mitigating Speculative Race Conditions.\n \n \n \n \n\n\n \n Ragab, H.; Mambretti, A.; Kurmus, A.; and Giuffrida, C.\n\n\n \n\n\n\n In USENIX Security, August 2024. \n \n\n\n\n
\n\n\n\n \n \n $\"GhostRace:$ Paper\n \n \n \n $\"GhostRace:$ Web\n \n \n \n $\"GhostRace:$ Code\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 356 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{ragab_ghostrace_2024,\n\ttitle = {{GhostRace}: {Exploiting} and {Mitigating} {Speculative} {Race} {Conditions}},\n\turl = {Paper=https://download.vusec.net/papers/ghostrace_sec24.pdf Web=https://www.vusec.net/projects/ghostrace Code=https://github.com/vusec/ghostrace},\n\tbooktitle = {{USENIX} {Security}},\n\tauthor = {Ragab, Hany and Mambretti, Andrea and Kurmus, Anil and Giuffrida, Cristiano},\n\tmonth = aug,\n\tyear = {2024},\n\tkeywords = {class\\_sidechannels, proj\\_allocamelus, proj\\_intersect, proj\\_rescale, type\\_conf, type\\_cve\\_assigned, type\\_paper, type\\_tier1, type\\_top},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n SafeFetch: Practical Double-Fetch Protection with Kernel-Fetch Caching.\n \n \n \n\n\n \n Duta, V.; Aloserij, M.; and Giuffrida, C.\n\n\n \n\n\n\n In USENIX Security, August 2024. \n \n\n\n\n
\n\n\n\n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{duta_safefetch_2024,\n\ttitle = {{SafeFetch}: {Practical} {Double}-{Fetch} {Protection} with {Kernel}-{Fetch} {Caching}},\n\tbooktitle = {{USENIX} {Security}},\n\tauthor = {Duta, Victor and Aloserij, Mitchel and Giuffrida, Cristiano},\n\tmonth = aug,\n\tyear = {2024},\n\tkeywords = {class\\_sanitizer, proj\\_allocamelus, proj\\_intersect, proj\\_rescale, proj\\_theseus, type\\_ae, type\\_conf, type\\_paper, type\\_tier1, type\\_top},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n Sticky Tags: Efficient and Deterministic Spatial Memory Error Mitigation using Persistent Memory Tags.\n \n \n \n\n\n \n Gorter, F.; Kroes, T.; Bos, H.; and Giuffrida, C.\n\n\n \n\n\n\n In S&P, May 2024. \n \n\n\n\n
\n\n\n\n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{gorter_sticky_2024,\n\ttitle = {Sticky {Tags}: {Efficient} and {Deterministic} {Spatial} {Memory} {Error} {Mitigation} using {Persistent} {Memory} {Tags}},\n\tbooktitle = {S\\&{P}},\n\tauthor = {Gorter, Floris and Kroes, Taddeus and Bos, Herbert and Giuffrida, Cristiano},\n\tmonth = may,\n\tyear = {2024},\n\tkeywords = {class\\_sanitizer, proj\\_allocamelus, proj\\_intersect, proj\\_rescale, proj\\_theseus, type\\_conf, type\\_paper, type\\_tier1, type\\_top},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n Leaky Address Masking: Exploiting Unmasked Spectre Gadgets with Noncanonical Address Translation.\n \n \n \n \n\n\n \n Hertogh, M.; Wiebing, S.; and Giuffrida, C.\n\n\n \n\n\n\n In S&P, May 2024. \n \n\n\n\n
\n\n\n\n \n \n $\"Leaky$ Paper\n \n \n \n $\"Leaky$ Web\n \n \n \n $\"Leaky$ Code\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 372 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{hertogh_leaky_2024,\n\ttitle = {Leaky {Address} {Masking}: {Exploiting} {Unmasked} {Spectre} {Gadgets} with {Noncanonical} {Address} {Translation}},\n\turl = {Paper=https://download.vusec.net/papers/slam_sp24.pdf Web=https://www.vusec.net/projects/slam Code=https://github.com/vusec/slam},\n\tbooktitle = {S\\&{P}},\n\tauthor = {Hertogh, Mathé and Wiebing, Sander and Giuffrida, Cristiano},\n\tmonth = may,\n\tyear = {2024},\n\tkeywords = {class\\_sidechannels, proj\\_allocamelus, proj\\_intersect, proj\\_rescale, type\\_conf, type\\_paper, type\\_tier1, type\\_top},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n Predictive Context-sensitive Fuzzing.\n \n \n \n \n\n\n \n Borrello, P.; Fioraldi, A.; D'Elia, D. C.; Balzarotti, D.; Querzoni, L.; and Giuffrida, C.\n\n\n \n\n\n\n In NDSS, February 2024. \n \n\n\n\n
\n\n\n\n \n \n $\"Predictive$ Paper\n \n \n \n $\"Predictive$ Code\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 43 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{borrello_predictive_2024,\n\ttitle = {Predictive {Context}-sensitive {Fuzzing}},\n\turl = {Paper=https://download.vusec.net/papers/pcsfuzzing_ndss24.pdf Code=https://github.com/eurecom-s3/predictive-cs-fuzzing},\n\tbooktitle = {{NDSS}},\n\tauthor = {Borrello, Pietro and Fioraldi, Andrea and D'Elia, Daniele Cono and Balzarotti, Davide and Querzoni, Leonardo and Giuffrida, Cristiano},\n\tmonth = feb,\n\tyear = {2024},\n\tkeywords = {class\\_testing, proj\\_intersect, proj\\_memo, proj\\_rescale, type\\_conf, type\\_paper, type\\_tier1, type\\_top},\n}\n\n

\n\n\n\n

\n\n\n\n\n\n

\n\n

\n \n 2023\n \n \n (10)\n \n \n

\n \n \n

\n \n\n \n \n \n \n \n \n Triereme: Speeding up Hybrid Fuzzing through Efficient Query Scheduling.\n \n \n \n \n\n\n \n Geretto, E.; Hohnerlein, J.; Giuffrida, C.; Bos, H.; Van Der Kouwe, E.; and von Gleissenthall, K.\n\n\n \n\n\n\n In ACSAC, December 2023. \n \n\n\n\n
\n\n\n\n \n \n $\"Triereme:$ Paper\n \n \n \n $\"Triereme:$ Code\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 21 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n Artifact Evaluation Badges:\n \n $\"Results$ \n \n $\"Artifacts$ \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{geretto_triereme_2023,\n\ttitle = {Triereme: {Speeding} up {Hybrid} {Fuzzing} through {Efficient} {Query} {Scheduling}},\n\turl = {Paper=https://download.vusec.net/papers/triereme_acsac23.pdf Code=https://github.com/vusec/triereme},\n\tbooktitle = {{ACSAC}},\n\tauthor = {Geretto, Elia and Hohnerlein, Julius and Giuffrida, Cristiano and Bos, Herbert and Van Der Kouwe, Erik and von Gleissenthall, Klaus},\n\tmonth = dec,\n\tyear = {2023},\n\tkeywords = {artifacts:reproduced, artifacts:reusable, class\\_testing, proj\\_intersect, proj\\_memo, type\\_ae, type\\_conf, type\\_paper, type\\_top},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n FloatZone: How Floating Point Additions can Detect Memory Errors.\n \n \n \n \n\n\n \n Gorter, F.; Barberis, E.; Isemann, R.; van der Kouwe, E.; Giuffrida, C.; and Bos, H.\n\n\n \n\n\n\n ;login:. November 2023.\n \n\n\n\n
\n\n\n\n \n \n $\"FloatZone:$ Paper\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 20 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@article{gorter_floatzone_2023,\n\ttitle = {{FloatZone}: {How} {Floating} {Point} {Additions} can {Detect} {Memory} {Errors}},\n\turl = {https://www.usenix.org/publications/loginonline/floatzone-how-floating-point-additions-can-detect-memory-errors},\n\tjournal = {;login:},\n\tauthor = {Gorter, Floris and Barberis, Enrico and Isemann, Raphael and van der Kouwe, Erik and Giuffrida, Cristiano and Bos, Herbert},\n\tmonth = nov,\n\tyear = {2023},\n\tkeywords = {class\\_sanitizer, proj\\_allocamelus, proj\\_intersect, proj\\_memo, proj\\_theseus, proj\\_tropics, type\\_mag, type\\_paper},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n Quarantine: Mitigating Transient Execution Attacks with Physical Domain Isolation.\n \n \n \n \n\n\n \n Hertogh, M.; Wiesinger, M.; Österlund, S.; Muench, M.; Amit, N.; Bos, H.; and Giuffrida, C.\n\n\n \n\n\n\n In RAID, October 2023. \n \n\n\n\n
\n\n\n\n \n \n $\"Quarantine:$ Paper\n \n \n \n $\"Quarantine:$ Code\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 53 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{hertogh_quarantine_2023,\n\ttitle = {Quarantine: {Mitigating} {Transient} {Execution} {Attacks} with {Physical} {Domain} {Isolation}},\n\turl = {Paper=https://download.vusec.net/papers/quarantine_raid23.pdf Code=https://github.com/vusec/quarantine},\n\tbooktitle = {{RAID}},\n\tauthor = {Hertogh, Mathé and Wiesinger, Manuel and Österlund, Sebastian and Muench, Marius and Amit, Nadav and Bos, Herbert and Giuffrida, Cristiano},\n\tmonth = oct,\n\tyear = {2023},\n\tkeywords = {class\\_sidechannels, proj\\_allocamelus, proj\\_intersect, proj\\_vmware, type\\_conf, type\\_paper, type\\_top},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n Speculation at Fault: Modeling and Testing Microarchitectural Leakage of CPU Exceptions.\n \n \n \n \n\n\n \n Hofmann, J.; Vannacci, E.; Fournet, C.; Köpf, B.; and Oleksenko, O.\n\n\n \n\n\n\n In USENIX Security, August 2023. \n \n\n\n\n
\n\n\n\n \n \n $\"Speculation$ Paper\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 23 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n Artifact Evaluation Badges:\n \n $\"Artifacts$ \n \n $\"Artifacts$ \n \n $\"Results$ \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{hofmann_speculation_2023,\n\ttitle = {Speculation at {Fault}: {Modeling} and {Testing} {Microarchitectural} {Leakage} of {CPU} {Exceptions}},\n\turl = {Paper=https://www.usenix.org/system/files/usenixsecurity23-hofmann.pdf},\n\tbooktitle = {{USENIX} {Security}},\n\tauthor = {Hofmann, Jana and Vannacci, Emanuele and Fournet, Cedric and Köpf, Boris and Oleksenko, Oleksii},\n\tmonth = aug,\n\tyear = {2023},\n\tkeywords = {artifacts:available, artifacts:functional, artifacts:reproduced, class\\_sidechannels, proj\\_intersect, type\\_ae, type\\_conf, type\\_paper, type\\_tier1, type\\_top},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n FloatZone: Accelerating Memory Error Detection using the Floating Point Unit.\n \n \n \n \n\n\n \n Gorter, F.; Barberis, E.; Isemann, R.; van der Kouwe, E.; Giuffrida, C.; and Bos, H.\n\n\n \n\n\n\n In USENIX Security, August 2023. \n \n\n\n\n
\n\n\n\n \n \n $\"FloatZone:$ Paper\n \n \n \n $\"FloatZone:$ Code\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 340 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n Artifact Evaluation Badges:\n \n $\"Artifacts$ \n \n $\"Artifacts$ \n \n $\"Results$ \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{gorter_floatzone_2023-1,\n\ttitle = {{FloatZone}: {Accelerating} {Memory} {Error} {Detection} using the {Floating} {Point} {Unit}},\n\turl = {Paper=https://download.vusec.net/papers/floatzone_sec23.pdf Code=https://github.com/vusec/floatzone},\n\tbooktitle = {{USENIX} {Security}},\n\tauthor = {Gorter, Floris and Barberis, Enrico and Isemann, Raphael and van der Kouwe, Erik and Giuffrida, Cristiano and Bos, Herbert},\n\tmonth = aug,\n\tyear = {2023},\n\tkeywords = {artifacts:available, artifacts:functional, artifacts:reproduced, class\\_sanitizer, proj\\_allocamelus, proj\\_intersect, proj\\_memo, proj\\_theseus, proj\\_tropics, type\\_ae, type\\_conf, type\\_paper, type\\_tier1, type\\_top},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n Uncontained: Uncovering Container Confusion in the Linux Kernel.\n \n \n \n \n\n\n \n Koschel, J.; Borrello, P.; D'Elia, D. C.; Bos, H.; and Giuffrida, C.\n\n\n \n\n\n\n In USENIX Security, August 2023. \n Distinguished Artifact Award, Pwnie Award Nomination for Best Privilege Escalation\n\n\n\n
\n\n\n\n \n \n $\"Uncontained:$ Paper\n \n \n \n $\"Uncontained:$ Web\n \n \n \n $\"Uncontained:$ Code\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 207 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n Artifact Evaluation Badges:\n \n $\"Artifacts$ \n \n $\"Artifacts$ \n \n $\"Results$ \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{koschel_uncontained_2023,\n\ttitle = {Uncontained: {Uncovering} {Container} {Confusion} in the {Linux} {Kernel}},\n\turl = {Paper=https://download.vusec.net/papers/uncontained_sec23.pdf Web=https://vusec.net/projects/uncontained Code=https://github.com/vusec/uncontained},\n\tbooktitle = {{USENIX} {Security}},\n\tauthor = {Koschel, Jakob and Borrello, Pietro and D'Elia, Daniele Cono and Bos, Herbert and Giuffrida, Cristiano},\n\tmonth = aug,\n\tyear = {2023},\n\tnote = {Distinguished Artifact Award, Pwnie Award Nomination for Best Privilege Escalation},\n\tkeywords = {artifacts:available, artifacts:functional, artifacts:reproduced, class\\_sanitizer, proj\\_allocamelus, proj\\_intersect, proj\\_memo, proj\\_theseus, proj\\_tropics, research\\_uncontained, type\\_ae, type\\_award, type\\_conf, type\\_paper, type\\_tier1, type\\_top, type\\_uncontained},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n Don't Look UB: Exposing Sanitizer-Eliding Compiler Optimizations.\n \n \n \n \n\n\n \n Isemann, R.; Giuffrida, C.; Bos, H.; Van Der Kouwe, E.; and von Gleissenthall, K.\n\n\n \n\n\n\n In PLDI, June 2023. \n \n\n\n\n
\n\n\n\n \n \n $\"Don't$ Paper\n \n \n \n $\"Don't$ Code\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 74 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n Artifact Evaluation Badges:\n \n $\"Artifacts$ \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{isemann_dont_2023,\n\ttitle = {Don't {Look} {UB}: {Exposing} {Sanitizer}-{Eliding} {Compiler} {Optimizations}},\n\turl = {Paper=https://download.vusec.net/papers/dontlookub_pldi23.pdf Code=https://github.com/vusec/LookUB},\n\tbooktitle = {{PLDI}},\n\tauthor = {Isemann, Raphael and Giuffrida, Cristiano and Bos, Herbert and Van Der Kouwe, Erik and von Gleissenthall, Klaus},\n\tmonth = jun,\n\tyear = {2023},\n\tkeywords = {artifacts:reusable, class\\_sanitizer, proj\\_allocamelus, proj\\_intersect, proj\\_memo, proj\\_theseus, type\\_ae, type\\_conf, type\\_paper, type\\_tier1, type\\_top},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n Enviral: Fuzzing the Environment for Evasive Malware Analysis.\n \n \n \n \n\n\n \n Gorter, F.; Giuffrida, C.; and van der Kouwe, E.\n\n\n \n\n\n\n In EuroSec, April 2023. \n \n\n\n\n
\n\n\n\n \n \n $\"Enviral:$ Paper\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 55 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{gorter_enviral_2023,\n\ttitle = {Enviral: {Fuzzing} the {Environment} for {Evasive} {Malware} {Analysis}},\n\turl = {Paper=https://download.vusec.net/papers/enviral_eurosec23.pdf},\n\tbooktitle = {{EuroSec}},\n\tauthor = {Gorter, Floris and Giuffrida, Cristiano and van der Kouwe, Erik},\n\tmonth = apr,\n\tyear = {2023},\n\tkeywords = {class\\_malware, proj\\_intersect, proj\\_memo, proj\\_theseus, proj\\_tropics, type\\_mscthesis, type\\_paper, type\\_workshop},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n Copy-on-Flip: Hardening ECC Memory Against Rowhammer Attacks.\n \n \n \n \n\n\n \n Di Dio, A.; Koning, K.; Bos, H.; and Giuffrida, C.\n\n\n \n\n\n\n In NDSS, February 2023. \n \n\n\n\n
\n\n\n\n \n \n $\"Copy-on-Flip:$ Paper\n \n \n \n $\"Copy-on-Flip:$ Code\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 88 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{di_dio_copy--flip_2023,\n\ttitle = {Copy-on-{Flip}: {Hardening} {ECC} {Memory} {Against} {Rowhammer} {Attacks}},\n\turl = {Paper=https://download.vusec.net/papers/cof_ndss23.pdf Code=https://github.com/vusec/Copy-on-Flip},\n\tbooktitle = {{NDSS}},\n\tauthor = {Di Dio, Andrea and Koning, Koen and Bos, Herbert and Giuffrida, Cristiano},\n\tmonth = feb,\n\tyear = {2023},\n\tkeywords = {class\\_rowhammer, proj\\_intersect, proj\\_offcore, proj\\_theseus, type\\_conf, type\\_mscthesis, type\\_paper, type\\_tier1, type\\_top},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n Let Me Unwind That For You: Exceptions to Backward-Edge Protection.\n \n \n \n \n\n\n \n Duta, V.; Freyer, F.; Pagani, F.; Muench, M.; and Giuffrida, C.\n\n\n \n\n\n\n In NDSS, February 2023. \n Intel Bounty Reward\n\n\n\n
\n\n\n\n \n \n $\"Let$ Paper\n \n \n \n $\"Let$ Code\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 100 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{duta_let_2023,\n\ttitle = {Let {Me} {Unwind} {That} {For} {You}: {Exceptions} to {Backward}-{Edge} {Protection}},\n\turl = {Paper=https://download.vusec.net/papers/chop_ndss23.pdf Code=https://github.com/chop-project/chop},\n\tbooktitle = {{NDSS}},\n\tauthor = {Duta, Victor and Freyer, Fabian and Pagani, Fabio and Muench, Marius and Giuffrida, Cristiano},\n\tmonth = feb,\n\tyear = {2023},\n\tnote = {Intel Bounty Reward},\n\tkeywords = {class\\_binary, proj\\_intersect, proj\\_memo, proj\\_offcore, proj\\_theseus, proj\\_tropics, type\\_award, type\\_bounty, type\\_conf, type\\_cve\\_assigned, type\\_paper, type\\_tier1, type\\_top},\n}\n\n

\n\n\n\n

\n\n\n\n\n\n

\n\n

\n \n 2022\n \n \n (12)\n \n \n

\n \n \n

\n \n\n \n \n \n \n \n Unwinding the Stack for Fun and Profit.\n \n \n \n\n\n \n Duta, V.; Freyer, F.; Pagani, F.; Muench, M.; and Giuffrida, C.\n\n\n \n\n\n\n In Black Hat Europe, December 2022. \n \n\n\n\n
\n\n\n\n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{duta_unwinding_2022,\n\ttitle = {Unwinding the {Stack} for {Fun} and {Profit}},\n\tbooktitle = {Black {Hat} {Europe}},\n\tauthor = {Duta, Victor and Freyer, Fabian and Pagani, Fabio and Muench, Marius and Giuffrida, Cristiano},\n\tmonth = dec,\n\tyear = {2022},\n\tkeywords = {class\\_binary, proj\\_intersect, proj\\_memo, proj\\_theseus, proj\\_tropics, type\\_conf, type\\_paper},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n Snappy: Efficient Fuzzing with Adaptive and Mutable Snapshots.\n \n \n \n \n\n\n \n Geretto, E.; Giuffrida, C.; Bos, H.; and van der Kouwe, E.\n\n\n \n\n\n\n In ACSAC, December 2022. \n \n\n\n\n
\n\n\n\n \n \n $\"Snappy:$ Paper\n \n \n \n $\"Snappy:$ Code\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 87 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n Artifact Evaluation Badges:\n \n $\"Artifacts$ \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{geretto_snappy_2022,\n\ttitle = {Snappy: {Efficient} {Fuzzing} with {Adaptive} and {Mutable} {Snapshots}},\n\turl = {Paper=https://download.vusec.net/papers/snappy_acsac22.pdf Code=https://github.com/vusec/snappy},\n\tbooktitle = {{ACSAC}},\n\tauthor = {Geretto, Elia and Giuffrida, Cristiano and Bos, Herbert and van der Kouwe, Erik},\n\tmonth = dec,\n\tyear = {2022},\n\tkeywords = {artifacts:functional, class\\_testing, proj\\_intersect, proj\\_memo, proj\\_theseus, proj\\_tropics, type\\_ae, type\\_conf, type\\_paper, type\\_top},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n DangZero: Efficient Use-After-Free Detection via Direct Page Table Access.\n \n \n \n \n\n\n \n Gorter, F.; Koning, K.; Bos, H.; and Giuffrida, C.\n\n\n \n\n\n\n In CCS, November 2022. \n \n\n\n\n
\n\n\n\n \n \n $\"DangZero:$ Paper\n \n \n \n $\"DangZero:$ Code\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 153 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{gorter_dangzero_2022,\n\ttitle = {{DangZero}: {Efficient} {Use}-{After}-{Free} {Detection} via {Direct} {Page} {Table} {Access}},\n\turl = {Paper=https://download.vusec.net/papers/dangzero_ccs22.pdf Code=https://github.com/vusec/dangzero},\n\tbooktitle = {{CCS}},\n\tauthor = {Gorter, Floris and Koning, Koen and Bos, Herbert and Giuffrida, Cristiano},\n\tmonth = nov,\n\tyear = {2022},\n\tkeywords = {class\\_sanitizer, proj\\_intersect, proj\\_memo, proj\\_theseus, proj\\_tropics, proj\\_unicore, type\\_conf, type\\_paper, type\\_tier1, type\\_top},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n Branch History Injection: On the Effectiveness of Hardware Mitigations Against Cross-Privilege Spectre-v2 Attacks.\n \n \n \n \n\n\n \n Barberis, E.; Frigo, P.; Muench, M.; Bos, H.; and Giuffrida, C.\n\n\n \n\n\n\n In USENIX Security, August 2022. \n Pwnie Award Nomination for Epic Achievement, Intel Bounty Reward\n\n\n\n
\n\n\n\n \n \n $\"Branch$ Paper\n \n \n \n $\"Branch$ Web\n \n \n \n $\"Branch$ Code\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 572 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n Artifact Evaluation Badges:\n \n $\"Artifacts$ \n \n $\"Artifacts$ \n \n $\"Results$ \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{barberis_branch_2022,\n\ttitle = {Branch {History} {Injection}: {On} the {Effectiveness} of {Hardware} {Mitigations} {Against} {Cross}-{Privilege} {Spectre}-v2 {Attacks}},\n\turl = {Paper=http://download.vusec.net/papers/bhi-spectre-bhb_sec22.pdf Web=https://www.vusec.net/projects/bhi-spectre-bhb Code=https://github.com/vusec/bhi-spectre-bhb},\n\tbooktitle = {{USENIX} {Security}},\n\tauthor = {Barberis, Enrico and Frigo, Pietro and Muench, Marius and Bos, Herbert and Giuffrida, Cristiano},\n\tmonth = aug,\n\tyear = {2022},\n\tnote = {Pwnie Award Nomination for Epic Achievement, Intel Bounty Reward},\n\tkeywords = {artifacts:available, artifacts:functional, artifacts:reproduced, class\\_sidechannels, proj\\_intersect, proj\\_offcore, proj\\_theseus, proj\\_tropics, proj\\_unicore, type\\_ae, type\\_award, type\\_bounty, type\\_conf, type\\_cve\\_assigned, type\\_paper, type\\_press, type\\_tier1, type\\_top},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n Fuzzware: Using Precise MMIO Modeling for Effective Firmware Fuzzing.\n \n \n \n \n\n\n \n Tobias Scharnowski; Nils Bars; Moritz Schloegel; Eric Gustafson; Marius Muench; Giovanni Vigna; Christopher Kruegel; Thorsten Holz; and Ali Abbasi\n\n\n \n\n\n\n In USENIX Security, August 2022. \n \n\n\n\n
\n\n\n\n \n \n $\"Fuzzware:$ Paper\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n \n \n abstract \n \n\n \n \n \n 67 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n Artifact Evaluation Badges:\n \n $\"Artifacts$ \n \n $\"Artifacts$ \n \n $\"Results$ \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{tobias_scharnowski_fuzzware_2022,\n\ttitle = {Fuzzware: {Using} {Precise} {MMIO} {Modeling} for {Effective} {Firmware} {Fuzzing}},\n\turl = {https://www.usenix.org/system/files/sec22summer_scharnowski.pdf},\n\tabstract = {As embedded devices are becoming more pervasive in our everyday lives, they turn into an attractive target for adversaries. Despite their high value and large attack surface, applying automated testing techniques such as fuzzing is not straightforward for such devices. As fuzz testing firmware on constrained embedded devices is inefficient, state-of-the-art approaches instead opt to run the firmware in an emulator (through a process called re-hosting). However, existing approaches either use coarse-grained static models of hardware behavior or require manual effort to re-host the firmware.\n\nWe propose a novel combination of lightweight program analysis, re-hosting, and fuzz testing to tackle these challenges. We present the design and implementation of Fuzzware, a software-only system to fuzz test unmodified monolithic firmware in a scalable way. By determining how hardware-generated values are actually used by the firmware logic, Fuzzware can automatically generate models that help focusing the fuzzing process on mutating the inputs that matter, which drastically improves its effectiveness.\n\nWe evaluate our approach on synthetic and real-world targets comprising a total of 19 hardware platforms and 77 firmware images. Compared to state-of-the-art work, Fuzzware achieves up to 3.25 times the code coverage and our modeling approach reduces the size of the input space by up to 95.5\\%. The synthetic samples contain 66 unit tests for various hardware interactions, and we find that our approach is the first generic re-hosting solution to automatically pass all of them. Fuzzware discovered 15 completely new bugs including bugs in targets which were previously analyzed by other works; a total of 12 CVEs were assigned.},\n\tbooktitle = {{USENIX} {Security}},\n\tauthor = {{Tobias Scharnowski} and {Nils Bars} and {Moritz Schloegel} and {Eric Gustafson} and {Marius Muench} and {Giovanni Vigna} and {Christopher Kruegel} and {Thorsten Holz} and {Ali Abbasi}},\n\tmonth = aug,\n\tyear = {2022},\n\tkeywords = {artifacts:available, artifacts:functional, artifacts:reproduced, class\\_binary, proj\\_intersect, proj\\_tropics, type\\_ae, type\\_conf, type\\_paper, type\\_tier1, type\\_top},\n}\n\n

\n\n\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n TLB;DR: Enhancing TLB-based Attacks with TLB Desynchronized Reverse Engineering.\n \n \n \n \n\n\n \n Tatar, A.; Trujillo, D.; Giuffrida, C.; and Bos, H.\n\n\n \n\n\n\n In USENIX Security, August 2022. \n \n\n\n\n
\n\n\n\n \n \n $\"TLB;DR:$ Paper\n \n \n \n $\"TLB;DR:$ Code\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 108 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n Artifact Evaluation Badges:\n \n $\"Artifacts$ \n \n $\"Artifacts$ \n \n $\"Results$ \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{tatar_tlbdr_2022,\n\ttitle = {{TLB};{DR}: {Enhancing} {TLB}-based {Attacks} with {TLB} {Desynchronized} {Reverse} {Engineering}},\n\turl = {Paper=https://download.vusec.net/papers/tlbdr_sec22.pdf Code=https://github.com/vusec/tlbdr},\n\tbooktitle = {{USENIX} {Security}},\n\tauthor = {Tatar, Andrei and Trujillo, Daniël and Giuffrida, Cristiano and Bos, Herbert},\n\tmonth = aug,\n\tyear = {2022},\n\tkeywords = {artifacts:available, artifacts:functional, artifacts:reproduced, class\\_sidechannels, proj\\_intersect, proj\\_offcore, proj\\_theseus, proj\\_tropics, proj\\_unicore, type\\_ae, type\\_conf, type\\_paper, type\\_tier1, type\\_top},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n BugsBunny: Hopping to RTL Targets with a Directed Hardware-Design Fuzzer.\n \n \n \n \n\n\n \n Ragab, H.; Koning, K.; Bos, H.; and Giuffrida, C.\n\n\n \n\n\n\n In SILM, June 2022. \n \n\n\n\n
\n\n\n\n \n \n $\"BugsBunny:$ Paper\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 59 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{ragab_bugsbunny_2022,\n\ttitle = {{BugsBunny}: {Hopping} to {RTL} {Targets} with a {Directed} {Hardware}-{Design} {Fuzzer}},\n\turl = {https://download.vusec.net/papers/bugsbunny_silm22.pdf},\n\tbooktitle = {{SILM}},\n\tauthor = {Ragab, Hany and Koning, Koen and Bos, Herbert and Giuffrida, Cristiano},\n\tmonth = jun,\n\tyear = {2022},\n\tkeywords = {class\\_testing, proj\\_intersect, proj\\_offcore, proj\\_tropics, type\\_paper, type\\_workshop},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n Spring: Spectre Returning in the Browser with Speculative Load Queuing and Deep Stacks.\n \n \n \n \n\n\n \n Wikner, J.; Giuffrida, C.; Bos, H.; and Razavi, K.\n\n\n \n\n\n\n In WOOT, May 2022. \n Mozilla Bounty Reward\n\n\n\n
\n\n\n\n \n \n $\"Spring:$ Paper\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 131 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{wikner_spring_2022,\n\ttitle = {Spring: {Spectre} {Returning} in the {Browser} with {Speculative} {Load} {Queuing} and {Deep} {Stacks}},\n\turl = {Paper=http://download.vusec.net/papers/spring_woot22.pdf},\n\tbooktitle = {{WOOT}},\n\tauthor = {Wikner, Johannes and Giuffrida, Cristiano and Bos, Herbert and Razavi, Kaveh},\n\tmonth = may,\n\tyear = {2022},\n\tnote = {Mozilla Bounty Reward},\n\tkeywords = {class\\_sidechannels, proj\\_intersect, proj\\_offcore, proj\\_tropics, type\\_award, type\\_bounty, type\\_mscthesis, type\\_paper, type\\_top, type\\_workshop},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n On the Effectiveness of Same-Domain Memory Deduplication.\n \n \n \n \n\n\n \n Costi, A.; Johannesmeyer, B.; Bosman, E.; Giuffrida, C.; and Bos, H.\n\n\n \n\n\n\n In EuroSec, April 2022. \n \n\n\n\n
\n\n\n\n \n \n $\"On$ Paper\n \n \n \n $\"On$ Slides\n \n \n \n $\"On$ Web\n \n \n \n $\"On$ Code\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 57 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{costi_effectiveness_2022,\n\ttitle = {On the {Effectiveness} of {Same}-{Domain} {Memory} {Deduplication}},\n\turl = {Paper=https://download.vusec.net/papers/dedupestreturns_eurosec22.pdf Slides=https://download.vusec.net/slides/dedup_eurosec22.pdf Web=https://www.vusec.net/projects/dedup-est-machina-returns/ Code=https://github.com/vusec/dedup-est-returns},\n\tbooktitle = {{EuroSec}},\n\tauthor = {Costi, Andreas and Johannesmeyer, Brian and Bosman, Erik and Giuffrida, Cristiano and Bos, Herbert},\n\tmonth = apr,\n\tyear = {2022},\n\tkeywords = {class\\_sidechannels, proj\\_intersect, proj\\_unicore, type\\_mscthesis, type\\_paper, type\\_workshop},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n Kasper: Scanning for Generalized Transient Execution Gadgets in the Linux Kernel.\n \n \n \n \n\n\n \n Johannesmeyer, B.; Koschel, J.; Razavi, K.; Bos, H.; and Giuffrida, C.\n\n\n \n\n\n\n In NDSS, April 2022. \n \n\n\n\n
\n\n\n\n \n \n $\"Kasper:$ Paper\n \n \n \n $\"Kasper:$ Slides\n \n \n \n $\"Kasper:$ Web\n \n \n \n $\"Kasper:$ Code\n \n \n \n $\"Kasper:$ Video\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 518 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{johannesmeyer_kasper_2022,\n\ttitle = {Kasper: {Scanning} for {Generalized} {Transient} {Execution} {Gadgets} in the {Linux} {Kernel}},\n\turl = {Paper=https://download.vusec.net/papers/kasper_ndss22.pdf Slides=https://download.vusec.net/slides/kasper_ndss22.pdf Web=https://www.vusec.net/projects/kasper Code=https://github.com/vusec/kasper Video=https://www.youtube.com/watch?v=v89Zt3vxrww},\n\tbooktitle = {{NDSS}},\n\tauthor = {Johannesmeyer, Brian and Koschel, Jakob and Razavi, Kaveh and Bos, Herbert and Giuffrida, Cristiano},\n\tmonth = apr,\n\tyear = {2022},\n\tkeywords = {class\\_sidechannels, proj\\_intersect, proj\\_offcore, proj\\_theseus, proj\\_tropics, proj\\_unicore, proj\\_veripatch, type\\_conf, type\\_paper, type\\_tier1, type\\_top},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n DupeFS: Leaking Data Over the Network With Filesystem Deduplication Side Channels.\n \n \n \n \n\n\n \n Bacs, A.; Musaev, S.; Razavi, K.; Giuffrida, C.; and Bos, H.\n\n\n \n\n\n\n In FAST, February 2022. \n \n\n\n\n
\n\n\n\n \n \n $\"DupeFS:$ Paper\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 127 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{bacs_dupefs_2022,\n\ttitle = {{DupeFS}: {Leaking} {Data} {Over} the {Network} {With} {Filesystem} {Deduplication} {Side} {Channels}},\n\turl = {Paper=https://download.vusec.net/papers/dupefs_fast22.pdf},\n\tbooktitle = {{FAST}},\n\tauthor = {Bacs, Andrei and Musaev, Saidgani and Razavi, Kaveh and Giuffrida, Cristiano and Bos, Herbert},\n\tmonth = feb,\n\tyear = {2022},\n\tkeywords = {class\\_sidechannels, proj\\_intersect, proj\\_offcore, proj\\_unicore, type\\_conf, type\\_mscthesis, type\\_paper, type\\_tier1, type\\_top},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n FirmWire: Transparent Dynamic Analysis for Cellular Baseband Firmware.\n \n \n \n \n\n\n \n Grant Hernandez; Marius Muench; Dominik Maier; Alyssa Milburn; Shinjo Park; Tobias Scharnowski; Tyler Tucker; Patrick Traynor; and Kevin R. B. Butler\n\n\n \n\n\n\n In NDSS, February 2022. \n \n\n\n\n
\n\n\n\n \n \n $\"FirmWire:$ Paper\n \n \n \n $\"FirmWire:$ Code\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 31 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{grant_hernandez_firmwire_2022,\n\ttitle = {{FirmWire}: {Transparent} {Dynamic} {Analysis} for {Cellular} {Baseband} {Firmware}},\n\turl = {Paper=https://hernan.de/research/papers/firmwire-ndss22-hernandez.pdf Code=https://github.com/FirmWire/FirmWire},\n\tbooktitle = {{NDSS}},\n\tauthor = {{Grant Hernandez} and {Marius Muench} and {Dominik Maier} and {Alyssa Milburn} and {Shinjo Park} and {Tobias Scharnowski} and {Tyler Tucker} and {Patrick Traynor} and {Kevin R. B. Butler}},\n\tmonth = feb,\n\tyear = {2022},\n\tkeywords = {class\\_binary, proj\\_intersect, proj\\_tropics, type\\_conf, type\\_paper, type\\_tier1, type\\_top},\n}\n\n

\n\n\n\n

\n\n\n\n\n\n

\n\n

\n \n 2021\n \n \n (3)\n \n \n

\n \n \n

\n \n\n \n \n \n \n \n \n LeanSym: Efficient Hybrid Fuzzing Through Conservative Constraint Debloating.\n \n \n \n \n\n\n \n Mi, X.; Rawat, S.; Giuffrida, C.; and Bos, H.\n\n\n \n\n\n\n In RAID, October 2021. \n \n\n\n\n
\n\n\n\n \n \n $\"LeanSym:$ Paper\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 41 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{mi_leansym_2021,\n\ttitle = {{LeanSym}: {Efficient} {Hybrid} {Fuzzing} {Through} {Conservative} {Constraint} {Debloating}},\n\turl = {https://download.vusec.net/papers/leansym_raid21.pdf},\n\tbooktitle = {{RAID}},\n\tauthor = {Mi, Xianya and Rawat, Sanjay and Giuffrida, Cristiano and Bos, Herbert},\n\tmonth = oct,\n\tyear = {2021},\n\tkeywords = {class\\_testing, proj\\_intersect, proj\\_memo, proj\\_theseus, proj\\_tropics, type\\_conf, type\\_paper, type\\_top},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n Rage Against the Machine Clear: A Systematic Analysis of Machine Clears and Their Implications for Transient Execution Attacks.\n \n \n \n \n\n\n \n Ragab, H.; Barberis, E.; Bos, H.; and Giuffrida, C.\n\n\n \n\n\n\n In USENIX Security, August 2021. \n Distinguished Paper Award, Intel Bounty Reward, Mozilla Bounty Reward, Pwnie Award Nomination for Most Innovative Research, Pwnie Award Nomination for Best Privilege Escalation Bug, Pwnie Award Nomination for Best Client-Side Bug, Pwnie Award Nomination for Epic Achievement, DCSR Paper Award, CSAW Best Paper Award Runner-up\n\n\n\n
\n\n\n\n \n \n $\"Rage$ Paper\n \n \n \n $\"Rage$ Web\n \n \n \n $\"Rage$ Code\n \n \n\n \n\n \n link\n \n \n\n bibtex\n \n\n \n\n \n \n \n 296 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{ragab_rage_2021,\n\ttitle = {Rage {Against} the {Machine} {Clear}: {A} {Systematic} {Analysis} of {Machine} {Clears} and {Their} {Implications} for {Transient} {Execution} {Attacks}},\n\turl = {Paper=https://download.vusec.net/papers/fpvi-scsb_sec21.pdf Web=https://www.vusec.net/projects/fpvi-scsb Code=https://github.com/vusec/fpvi-scsb},\n\tbooktitle = {{USENIX} {Security}},\n\tauthor = {Ragab, Hany and Barberis, Enrico and Bos, Herbert and Giuffrida, Cristiano},\n\tmonth = aug,\n\tyear = {2021},\n\tnote = {Distinguished Paper Award, Intel Bounty Reward, Mozilla Bounty Reward, Pwnie Award Nomination for Most Innovative Research, Pwnie Award Nomination for Best Privilege Escalation Bug, Pwnie Award Nomination for Best Client-Side Bug, Pwnie Award Nomination for Epic Achievement, DCSR Paper Award, CSAW Best Paper Award Runner-up},\n\tkeywords = {class\\_sidechannels, proj\\_intersect, proj\\_offcore, proj\\_react, proj\\_unicore, type\\_award, type\\_bounty, type\\_conf, type\\_cve\\_assigned, type\\_paper, type\\_tier1, type\\_top},\n}\n\n

\n\n\n\n

\n\n\n

\n \n\n \n \n \n \n \n \n SoK: Enabling Security Analyses of Embedded Systems via Rehosting.\n \n \n \n \n\n\n \n Fasano, A.; Ballo, T.; Muench, M.; Leek, T.; Bulekov, A.; Dolan-Gavitt, B.; Egele, M.; Francillon, A.; Lu, L.; Gregory, N.; Balzarotti, D.; and Robertson, W.\n\n\n \n\n\n\n In ASIACCS, May 2021. \n \n\n\n\n
\n\n\n\n \n \n $\"SoK:$ Paper\n \n \n\n \n \n doi\n \n \n\n \n link\n \n \n\n bibtex\n \n\n \n \n \n abstract \n \n\n \n \n \n 21 downloads\n \n \n\n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n\n

@inproceedings{fasano_sok_2021,\n\ttitle = {{SoK}: {Enabling} {Security} {Analyses} of {Embedded} {Systems} via {Rehosting}},\n\turl = {https://dl.acm.org/doi/pdf/10.1145/3433210.3453093},\n\tdoi = {10.1145/3433210.3453093},\n\tabstract = {Closely monitoring the behavior of a software system during its execution enables developers and analysts to observe, and ultimately understand, how it works. This kind of dynamic analysis can be instrumental to reverse engineering, vulnerability discovery, exploit development, and debugging. While these analyses are typically well-supported for homogeneous desktop platforms (e.g., x86 desktop PCs), they can rarely be applied in the heterogeneous world of embedded systems. One approach to enable dynamic analyses of embedded systems is to move software stacks from physical systems into virtual environments that sufficiently model hardware behavior. This process which we call "rehosting" poses a significant research challenge with major implications for security analyses. Although rehosting has traditionally been an unscientific and ad-hoc endeavor undertaken by domain experts with varying time and resources at their disposal, researchers are beginning to address rehosting challenges systematically and in earnest. In this paper, we establish that emulation is insufficient to conduct large-scale dynamic analysis of real-world hardware systems and present rehosting as a firmware-centric alternative. Furthermore, we taxonomize preliminary rehosting efforts, identify the fundamental components of the rehosting process, and propose directions for future research.},\n\tbooktitle = {{ASIACCS}},\n\tauthor = {Fasano, Andrew and Ballo, Tiemoko and Muench, Marius and Leek, Tim and Bulekov, Alexander and Dolan-Gavitt, Brendan and Egele, Manuel and Francillon, Aurélien and Lu, Long and Gregory, Nick and Balzarotti, Davide and Robertson, William},\n\tmonth = may,\n\tyear = {2021},\n\tkeywords = {class\\_binary, dynamic program analysis, embedded systems, emulation, firmware security, internet of things, proj\\_intersect, proj\\_tropics, rehosting, type\\_conf, type\\_paper, type\\_top, virtualization},\n}\n

\n\n\n\n\n\n

\n\n\n\n\n

\n\n\n \n\n \n \n \n \n\n