As we move to memory safe language, pointer arithmetic no longer is the main source of bugs, instead API misuse becomes a key issue. Complex code is hidden behind API abstractions and developers may make mistakes in how they use these APIs. While API mining has been an active field …
read moreOther articles
CrossFit: Demystifying VM Callback Bugs
Scripting languages are an essential part of many software environments. Common languages like Python, Ruby, or PHP power large parts of the modern web but bugs in their runtime environments allow attackers to break memory safety and sandboxing guarantees. A common bug class is callback bugs which happen when user-defined …
read morePrivacyShield: Privacy-aware Tracking Protection
Trackers like Apple's FindMy devices have seen an incredible boom throughout the last few years and are used for a variety of use-cases such as tracking lost luggage, stolen bikes, or simply finding one's lost keys. But they may also be used by stalkers to track their victims. Our goal …
read moreExploiting Android Apps with Counterfeit Art
Arbitrary file overwrite vulnerabilities are, unfortunately, quite common in Android apps. Often the adversary can control some part of the path to partially or fully overwrite files in the file system of the application. The attacker thereby has the power to modify any file writable by the application. The attacker …
read moreGrape: Squeezing Juicy Variant Bugs Out of Modern Browsers
Fuzzing has become the dominant dynamic testing approach to find bugs in software. For complex software like Chrome, we observed that fuzzing only reaches around 30% of coverage, i.e., 70% of code is not executed and therefore not tested. While not all code will be reachable in practice, there's …
read moreSymCTS: Untangling Symbolic Execution and Fuzzing
Bug discovery has long been a key concern in the field of software security. Bugs are plentiful and many impact security. When bugs are discovered and fixed, the underlying risk is mitigated. A wide variety of techniques exist from formal verification over symbolic execution to fuzzing.
Out of those techniques …
read moreTÄMU: Emulating Trusted Applications
Android runs sensitive applications in the so-called "secure world". These trusted applications (TAs) handle sensitive operations such as authentication, key management, or DRM. As they interact with regular Android applications from the normal world, vulnerabilities in these applications compromise the secure world and give adversaries access to privileged data. Our …
read moreSysyphuzz: the pressure for more coverage
Fuzzing faces a key challenge: after running for an extensive time, coverage plateaus and will no longer increase despite extensive mutations. Only new seed inputs or mutation operators will likely change that. We have observed that for Syzbot fuzzing in the Linux kernel has essentially plateaued due to Google's multi-year …
read moreDroidot: Vulnerable Native Libraries on Android
Android is a complex platform with diverse, concurrently running services. Looking at user-space the assumption is that each app is isolated from all others running on top of the rich Android runtime system. Unfortunately, the available system libraries are heavily limited and Android apps often ship diverse libraries. These libraries …
read more