As we move to memory safe language, pointer arithmetic no longer is the main source of bugs, instead API misuse becomes a key issue. Complex code is hidden behind API abstractions and developers may make mistakes in how they use these APIs. While API mining has been an active field …
read moreOther articles
CrossFit: Demystifying VM Callback Bugs
Scripting languages are an essential part of many software environments. Common languages like Python, Ruby, or PHP power large parts of the modern web but bugs in their runtime environments allow attackers to break memory safety and sandboxing guarantees. A common bug class is callback bugs which happen when user-defined …
read morePrivacyShield: Privacy-aware Tracking Protection
Trackers like Apple's FindMy devices have seen an incredible boom throughout the last few years and are used for a variety of use-cases such as tracking lost luggage, stolen bikes, or simply finding one's lost keys. But they may also be used by stalkers to track their victims. Our goal …
read moreExploiting Android Apps with Counterfeit Art
Arbitrary file overwrite vulnerabilities are, unfortunately, quite common in Android apps. Often the adversary can control some part of the path to partially or fully overwrite files in the file system of the application. The attacker thereby has the power to modify any file writable by the application. The attacker …
read moreGrape: Squeezing Juicy Variant Bugs Out of Modern Browsers
Fuzzing has become the dominant dynamic testing approach to find bugs in software. For complex software like Chrome, we observed that fuzzing only reaches around 30% of coverage, i.e., 70% of code is not executed and therefore not tested. While not all code will be reachable in practice, there's …
read moreSymCTS: Untangling Symbolic Execution and Fuzzing
Bug discovery has long been a key concern in the field of software security. Bugs are plentiful and many impact security. When bugs are discovered and fixed, the underlying risk is mitigated. A wide variety of techniques exist from formal verification over symbolic execution to fuzzing.
Out of those techniques …
read moreIEEE Symposium on Security and Privacy (Oakland) '26
What a great time at the IEEE Symposium on Security and Privacy (informally called Oakland) in San Francisco. With about 700 attendees, Oakland now seems the smallest of the top four security conferences. It was great to meet many friends and make new ones during the three days of the …
read moreTÄMU: Emulating Trusted Applications
Android runs sensitive applications in the so-called "secure world". These trusted applications (TAs) handle sensitive operations such as authentication, key management, or DRM. As they interact with regular Android applications from the normal world, vulnerabilities in these applications compromise the secure world and give adversaries access to privileged data. Our …
read moreThe AIpocalypse or how LLM-based exploitation is the new normal
In the last 3-4 months, AI models have made an immense jump in exploitation capabilities. Several talks and blog posts highlight the "new" capabilities of frontier AI models. The agents have learned from countless CTF writeups, research papers on exploitation techniques, and conference talks/demonstrations on how to automate diverse …
read more