Network and Distributed System Security (NDSS) Symposium 2024
The 31st annual NDSS Symposium, a top-tier academic security conference hosted by the Internet Society, featuring 140 peer-reviewed papers on network and distributed system security.
- Decentralized Information-Flow Control for ROS2 — Nishit V. Pandya
This article delves into Picaros, a novel system for Decentralized Information-Flow Control (DIFC) specifically designed for ROS2 (Robot Operating System 2). Presented by Nishit V. Pandya from the…
- Facilitating Non-Intrusive In-Vivo Firmware Testing with Stateless Instrumentation — Jiameng Shi
Dynamic testing techniques, ubiquitous in general software development, face formidable challenges when applied to firmware on deeply embedded devices like microcontrollers (MCUs). These devices…
- LDR: Secure and Efficient Linux Driver Runtime for Embedded TEE Systems — Huaiyu Yan
This talk introduces the Linux Driver Runtime, or LDR, a novel execution environment designed to bring robust, secure, and efficient device driver support to Trusted Execution Environments (TEEs)…
- Content Censorship in the InterPlanetary File System — Srivatsan Sridhar
The InterPlanetary File System (IPFS) stands as the largest decentralized storage solution globally, underpinning thousands of participants and facilitating millions of daily content transfers. It…
- On Precisely Detecting Censorship Circumvention in Real-World Networks — Ryan Wails
This talk, presented by Ryan Wails at the NDSS Symposium, addresses a critical and often underestimated challenge in the cat-and-mouse game of internet censorship: the precise detection of…
- Modeling and Detecting Internet Censorship Events — Elisa Tsai
In an era where internet freedom is increasingly challenged, understanding and detecting censorship events is paramount for human rights organizations, journalists, and researchers. However, the…
- Efficient and Timely Revocation of V2X Credentials — Gianluca Scopelliti
In the rapidly evolving landscape of Intelligent Transport Systems (ITS), the security and trustworthiness of Vehicle-to-Everything (V2X) communication are paramount for ensuring road safety and…
- Towards Precise Reporting of Cryptographic Misuses — Yikang Chen
Modern software relies heavily on cryptographic Application Programming Interfaces (APIs) to secure data and communications. However, developers frequently misuse these complex APIs, leading to…
- A Unified Symbolic Analysis of WireGuard — Pascal Lafourcade
This talk presents a groundbreaking, unified symbolic analysis of the WireGuard protocol, a modern VPN solution rapidly gaining adoption due to its simplicity and robustness. Given by Pascal…
- ReqsMiner: Automated Discovery of CDN Forwarding Request Inconsistencies and DoS Attacks with Grammar-based Fuzzing — Linkai Zheng
Content Delivery Networks (CDNs) are fundamental components of modern internet infrastructure, crucial for accelerating content delivery and providing robust security against various online threats…
- Large Language Model guided Protocol Fuzzing — Ruijie Meng
This article delves into "Large Language Model guided Protocol Fuzzing," a groundbreaking approach presented at the NDSS Symposium. The talk, delivered by Ruijie Meng, addresses a critical and…
- ShapFuzz: Efficient Fuzzing via Shapley-Guided Byte Selection — Kunpeng Zhang
Mutation-based fuzzing stands as a critical technique in the arsenal of vulnerability researchers, instrumental in uncovering software bugs and exploring uncharted code paths. Despite its widespread…
- Flow Correlation Attacks on Tor Onion Service Sessions with Sliding Subset Sum — Daniela Lopes
In a significant presentation at the NDSS Symposium, Daniela Lopes unveiled SUMo, a novel and highly effective flow correlation attack specifically engineered to deanonymize Tor onion service…
- MirageFlow: A New Bandwidth Inflation Attack on Tor — Christoph Sendner
In a critical presentation at the NDSS Symposium, Christoph Sendner unveiled "MirageFlow," a novel and potent bandwidth inflation attack that poses a significant threat to the Tor network's…
- LARMix: Latency-Aware Routing in Mix Networks — Mahdi Rahimi
Anonymous communication systems, such as mix networks, are vital tools for preserving user privacy online. However, their core mechanism of reordering and delaying messages to achieve anonymity…
- The CURE to Vulnerabilities in RPKI Validation — Donika Mirdita
The Border Gateway Protocol (BGP), the foundational routing protocol of the Internet, faces a critical and persistent vulnerability: route hijacks. Due to BGP's inherent trust model, any router can…
- dRR: A Decentralized, Scalable, and Auditable Architecture for RPKI Repository — Yingying Su
The talk introduces dRR, a novel architecture designed to fortify the Resource Public Key Infrastructure (RPKI) Repository, a critical element for securing inter-domain routing and preventing IP…
- IRRedicator: Pruning IRR with RPKI-Valid BGP Insights — Minhyeok Kang
The Internet's routing infrastructure, underpinned by the Border Gateway Protocol (BGP), faces persistent security vulnerabilities due to its foundational design prioritizing stability over…
- Proof of Backhaul: Trustfree Measurement of Broadband Bandwidth — Peiyao Sheng
The talk "Proof of Backhaul: Trustfree Measurement of Broadband Bandwidth" by Peiyao Sheng introduces a groundbreaking protocol designed to securely and transparently measure the broadband backhaul…
- Understanding the Implementation and Security Implications of Protective DNS Services — Mingxuan Liu
The internet's utility is constantly challenged by the proliferation of malicious domain names, which serve as critical infrastructure for cyberattacks such as botnet command and control, phishing…
- BGP-iSec: Improved Security of Internet Routing Against Post-ROV Attacks — Cameron Morris
The Border Gateway Protocol (BGP) has been the foundational routing protocol for the internet for decades, yet its inherent security vulnerabilities have been a persistent concern since its…
- Symphony: Path Validation at Scale — Anxiao He
In this presentation at the NDSS Symposium, Anxiao He introduced "Symphony: Path Validation at Scale," a groundbreaking work addressing a fundamental security challenge in future Internet…
- Beyond the Surface: Uncovering the Unprotected Components of Android Against Overlay Attack — Hao Zhou
The Android operating system, renowned for its flexibility and user experience, incorporates a powerful feature known as overlays or floating windows. This functionality allows applications to draw…
- 50 Shades of Support: A Device-Centric Analysis of Android Security Updates — Abbas Acar
Android, the world's most popular mobile operating system with over three billion active devices, faces a persistent challenge in delivering timely and consistent security updates to its vast user…
- QUACK: Hindering Deserialization Attacks via Static Duck Typing — Yaniv David
Deserialization vulnerabilities represent a pervasive and critical threat in modern software development, consistently ranking among the OWASP Top 10 for web application security risks. Attackers…
- Automatic Policy Synthesis and Enforcement for Protecting Untrusted Deserialization — Quan Zhang
Java deserialization vulnerabilities represent a persistent and critical security threat to modern applications. Attackers exploit these flaws by injecting meticulously crafted malicious objects…
- FP-Fed: Privacy-Preserving Federated Detection of Browser Fingerprinting — Meenatchi Sundaram Muthu Selva Annamalai
This article delves into FP-Fed, a groundbreaking system designed for the Privacy-Preserving Federated Detection of Browser Fingerprinting. Presented at the NDSS Symposium by Meenatchi Sundaram…
- CrowdGuard: Federated Backdoor Detection in Federated Learning — Phillip Rieger
CrowdGuard introduces a pioneering defense mechanism designed to robustly detect and mitigate backdoor attacks within Federated Learning (FL) environments. Presented by Phillip Rieger, this talk…
- Automatic Adversarial Adaption for Stealthy Poisoning Attacks in Federated Learning — Torsten Krauß
Federated Learning (FL) has emerged as a transformative paradigm for collaboratively training machine learning models across distributed datasets, offering compelling advantages in data privacy…
- FreqFed: A Frequency Analysis-Based Approach for Mitigating Poisoning Attacks in Federated Learning — Hossein Fereidooni
Federated Learning (FL) has emerged as a crucial paradigm for collaborative machine learning, enabling multiple clients to jointly train a global model without sharing their sensitive local data…
- Acoustic Keystroke Leakage on Smart Televisions — Tejas Kannan
This talk, presented by Tejas Kannan at the NDSS Symposium, uncovers a novel acoustic side-channel attack targeting the virtual keyboards of popular Smart Televisions (Smart TVs). With projections…
- IdleLeak: Exploiting Idle State Side Effects for Information Leakage — Fabian Rauscher
Fabian Rauscher's presentation at the NDSS Symposium unveils IdleLeak, a novel side-channel attack that exploits previously unexplored behaviors of modern CPU idle states. Modern processors…
- TEE-SHirT: Scalable Leakage-Free Cache Hierarchies for TEEs — Kerem Arikan
The talk "TEE-SHirT: Scalable Leakage-Free Cache Hierarchies for TEEs," presented by Kerem Arikan at the NDSS Symposium, addresses a fundamental and persistent challenge in secure computing…
- Exploiting Sequence Number Leakage: TCP Hijacking in NAT-Enabled Wi-Fi Networks — Yuxiang Yang
This talk, presented by Yuxiang Yang at the NDSS Symposium, uncovers a novel and potent off-path TCP hijacking attack targeting Wi-Fi networks that employ Network Address Translation (NAT). The…
- GNNIC: Finding Long-Lost Sibling Functions with Abstract Similarity — Qiushi Wu
The talk "GNNIC: Finding Long-Lost Sibling Functions with Abstract Similarity," presented by Qiushi Wu at the NDSS Symposium, addresses a pervasive and critical challenge in program analysis: the…
- Group-based Robustness: A General Framework for Customized Robustness in the Real World — Weiran Lin
In an era where machine learning models are increasingly integrated into critical real-world applications, their vulnerability to sophisticated evasion attacks poses a significant threat. Weiran…
- Experimental Analyses of the Physical Surveillance Risks in Client-Side Content Scanning — Ashish Hooda
The proliferation of end-to-end encryption (E2EE) in digital communication platforms, while a boon for user privacy, has presented a significant challenge for detecting and mitigating the spread of…
- Timing Channels in Adaptive Neural Networks — Ayomide Akinsanya
Modern deep neural networks (DNNs) have revolutionized various fields with their impressive predictive capabilities, yet they often demand substantial computational resources. This challenge has…
- AnonPSI: An Anonymity Assessment Framework for PSI — Bo Jiang
This talk introduces AnonPSI, a comprehensive framework designed for assessing the anonymity and privacy leakage of Private Set Intersection (PSI) protocols. PSI is a foundational cryptographic…
- Unus pro omnibus: Multi-Client Searchable Encryption via Access Control — Jiafan Wang
This article delves into "Unus pro omnibus: Multi-Client Searchable Encryption via Access Control," a talk presented by Jiafan Wang at the NDSS Symposium. The core focus of this research is to…
- Pisces: Private and Compliable Cryptocurrency Exchange — Ya-Nan Li
"Pisces: Private and Compliable Cryptocurrency Exchange" introduces a groundbreaking system designed to address a critical privacy vulnerability inherent in modern centralized cryptocurrency…
- Secret-Shared Shuffle with Malicious Security — Xiangfu Song
This article delves into the critical advancements presented in the talk "Secret-Shared Shuffle with Malicious Security." Secret-Shared Shuffle (SSS) protocols are foundational primitives within…
- SENSE: Enhancing Microarchitectural Awareness for TEEs via Subscription-Based Notification — Fan Sang
Trusted Execution Environments (TEEs) are critical for securing sensitive computations, but they face a persistent and formidable adversary in side-channel attacks (SCAs). Despite continuous…
- EnclaveFuzz: Finding Vulnerabilities in SGX Applications — Liheng Chen
Intel's Software Guard Extensions (SGX) provides a robust hardware-isolated execution environment, known as an enclave, designed to protect sensitive code and data from a potentially malicious…
- Faults in Our Bus: Novel Bus Fault Attack to Break ARM TrustZone — Nimish Mishra
The proliferation of Internet of Things (IoT) devices, often powered by complex, high-frequency Systems-on-a-Chip (SoCs), presents a significant security challenge. With billions of connected…
- Parrot-Trained Adversarial Examples: Pushing the Practicality of Black-Box Audio Attacks against Speaker Recognition Models — Rui Duan
Speaker recognition systems, ubiquitous in smart devices and security applications, face a significant and evolving threat from audio adversarial examples (AEs). While advancements in black-box…
- Attributions for ML-based ICS Anomaly Detection: From Theory to Practice — Clement Fung
Industrial Control Systems (ICS) form the bedrock of critical infrastructure, orchestrating vital processes from power generation to water treatment. The integrity of these systems is paramount, as…
- TextGuard: Provable Defense against Backdoor Attacks on Text Classification — Hengzhi Pei
In an era increasingly reliant on machine learning models for critical applications, the integrity and trustworthiness of these systems are paramount. This article delves into TextGuard, a…
- When Cryptography Needs a Hand: Practical Post-Quantum Authentication for V2V Communications — Geoff Twardokus
This talk, "When Cryptography Needs a Hand: Practical Post-Quantum Authentication for V2V Communications," presented by Geoff Twardokus, addresses the critical and immediate threat quantum computing…
- HEIR: A Unified Representation for Cross-Scheme Compilation of Fully Homomorphic Computation — Song Bian
Fully Homomorphic Encryption (FHE) stands as a cornerstone of secure multi-party computation, enabling computations on encrypted data without ever decrypting it. This powerful cryptographic…
- Powers of Tau in Asynchrony — Sourav Das
Sourav Das’s talk, "Powers of Tau in Asynchrony," introduces a groundbreaking distributed protocol for securely and robustly generating q-Strong Diffie-Hellman (q-SDH) parameters in an asynchronous…
- Scrappy: SeCure Rate Assuring Protocol with PrivacY — Kosei Akama
The internet’s reliance on online services has brought with it an escalating challenge: how to mitigate abusive activities without compromising user privacy or degrading the user experience…
- Information Based Heavy Hitters for Real-Time DNS Data Exfiltration Detection — Yarin Ozery
Data exfiltration over the Domain Name System (DNS) protocol remains a persistent and significant cybersecurity threat. Malicious actors, ranging from state-sponsored groups to ransomware operators…
- BreakSPF: How Shared Infrastructures Magnify SPF Vulnerabilities Across the Internet — Chuhan Wang
Email spoofing remains a pervasive and dangerous threat, enabling attackers to impersonate legitimate senders for phishing, spam, and fraud. The Sender Policy Framework (SPF) is a foundational email…
- Understanding Route Origin Validation (ROV) Deployment in the Real World and Why MANRS Action 1 Is Not Followed — Lancheng Qin
BGP hijacking remains a persistent and critical threat to the stability and security of the global Internet routing system. In 2021 alone, BGPStream reported a staggering 775 hijacking incidents…
- UntrustIDE: Exploiting Weaknesses in VS Code Extensions — Elizabeth Lin
In an era where the software supply chain faces relentless attack, developer Integrated Development Environments (IDEs) have emerged as a critical, yet often overlooked, target. The talk…
- SyzBridge: Bridging the Gap in Exploitability Assessment of Linux Kernel Bugs in the Linux Ecosystem — Xiaochen Zou
Continuous fuzzing, exemplified by platforms like syzbot, has become an indispensable component of the Linux kernel development ecosystem, successfully unearthing thousands of bugs. However, a…
- File Hijacking Vulnerability: The Elephant in the Room — Chendong Yu
In this NDSS Symposium talk, Chendong Yu presented "File Hijacking Vulnerability: The Elephant in the Room," a comprehensive analysis of File Hijacking Vulnerabilities (FHVulns). FHVulns represent a…
- Phoenix: Surviving Unpatched Vulnerabilities via Accurate and Efficient Filtering of Syscall Sequences — Hugo Kermabon-Bobinnec
The digital landscape is relentlessly challenged by unpatched vulnerabilities, posing a severe dilemma for businesses: risk exposure by keeping vulnerable services online or incur significant…
- CAGE: Complementing Arm CCA with GPU Extensions — Chenxu Wang
Confidential computing stands as a cornerstone in modern data security, promising isolated and transparent execution environments that shield sensitive data from a spectrum of threats, including…
- Architecting Trigger-Action Platforms for Security, Performance and Functionality — Deepak Sirone Jegan
Trigger-Action Platforms (TAPs) like IFTTT, Zapier, and Microsoft Power Automate have become indispensable tools for end-users, enabling seamless automation of interactions between diverse web…
- Understanding and Analyzing Appraisal Systems in the Underground Marketplaces — Zhengyi Li
This talk, presented by Zhengyi Li at the NDSS Symposium, delves into the burgeoning phenomenon of appraisal systems within underground online marketplaces. These illicit platforms, much like their…
- Like, Comment, Get Scammed: Characterizing Comment Scams on Media Platforms — Xigao Li
In an era dominated by vast digital media platforms like YouTube, the sheer volume of user engagement creates fertile ground for cybercriminals. This talk, "Like, Comment, Get Scammed…
- Front-running Attack in Sharded Blockchains and Fair Cross-shard Consensus — Jianting Zhang
This talk by Jianting Zhang from the NDSS Symposium unveils a critical, previously unaddressed security vulnerability in sharded blockchains: a novel form of front-running attack that exploits a…
- A Two-Layer Blockchain Sharding Protocol Leveraging Safety and Liveness for Enhanced Performance — Yibin Xu
Blockchain technology has ushered in a new era of decentralized applications, but its widespread adoption is often hindered by inherent scalability limitations. The challenge lies in processing a…
- Secure Multiparty Computation of Threshold Signatures Made More Efficient — Harry W. H. Wong
This article delves into Harry W. H. Wong's presentation on enhancing the efficiency of secure multiparty computation (SMC) for threshold signatures, a critical cryptographic primitive for securing…
- Separation is Good: A Faster Order-Fairness Byzantine Consensus — Ke Mu
This article delves into SpeedyFair, a novel high-performance Byzantine Fault-Tolerant (BFT) consensus protocol designed to address the pervasive problem of adversarial transaction order…
- ORL-AUDITOR: Dataset Auditing in Offline Deep Reinforcement Learning — Linkang Du
In the rapidly evolving landscape of artificial intelligence, Deep Reinforcement Learning (DRL) has emerged as a transformative paradigm, driving innovation across complex decision-making domains…
- DRAINCLoG: Detecting Rogue Accounts with Illegally-obtained NFTs using Classifiers Learned on Graphs — Hanna Kim
This article delves into DRAINCLoG, a groundbreaking research initiative presented at the NDSS Symposium, focused on combating the escalating threat of NFT drainers within the Non-Fungible Token…
- MPCDiff: Testing and Repairing MPC-Hardened Deep Learning Models — Qi Pang
Secure Multi-Party Computation (MPC) has emerged as a foundational technology for privacy-preserving machine learning, enabling multiple entities to collaboratively execute computations on sensitive…
- K-LEAK: Towards Automating the Generation of Multi-Step Infoleak Exploits against the Linux Kernel — Zhengchuan Liang
The security of the operating system kernel is paramount, as it forms the trusted computing base for all modern systems. Despite continuous efforts, memory errors such as out-of-bounds (OOB) and…
- Sharing cyber threat intelligence: Does it really help? — Beomjin Jin
In an era of relentlessly escalating cyber threats, the effective sharing of Cyber Threat Intelligence (CTI) is paramount for robust security postures. Beomjin Jin's talk, "Sharing cyber threat…
- Bernoulli Honeywords — Ke Coby Wang
Ke Coby Wang's presentation on "Bernoulli Honeywords" at the NDSS Symposium introduces a groundbreaking methodology for the proactive detection of credential database breaches. This work directly…
- Towards Automated Regulation Analysis for Effective Privacy Compliance — Sunil Manandhar
In a world increasingly shaped by digital interactions, the proliferation of privacy and data protection regulations presents a formidable challenge for businesses and researchers alike. Sunil…
- ActiveDaemon: Unconscious DNN Dormancy and Waking Up via User-specific Invisible Token — Ge Ren
Deep Neural Networks (DNNs) have become indispensable assets in modern commerce, powering everything from natural language processing to advanced content generation. However, the substantial…
- Maginot Line: Assessing a New Cross-app Threat to PII-as-Factor Authentication in Chinese Mobile Apps — Fannv He
In the rapidly evolving landscape of mobile application security, especially within the vast Chinese digital ecosystem, the reliance on Personally Identifiable Information (PII) as an authentication…
- AAKA: An Anti-Tracking Cellular Authentication Scheme Leveraging Anonymous Credentials — Hexuan Yu
The talk introduces AAKA, a novel Anti-Tracking Cellular Authentication Scheme designed to address the persistent privacy concern of mobile tracking by Mobile Network Operators (MNOs). MNOs…
- 5G-Spector: An O-RAN Compliant Layer-3 Cellular Attack Detection Service — Haohuang Wen
In the rapidly evolving landscape of 5G mobile networks, the transition to Open Radio Access Network (O-RAN) architecture presents both unprecedented opportunities and significant security…
- Leaking the Privacy of Groups and More: Understanding Privacy Risks of Cross-App Content Sharing in Mobile Ecosystem — Jiangrong Wu
Cross-app content sharing, or Cracs, is a pervasive feature in modern mobile applications, enabling users to effortlessly share content like videos or articles between different platforms. While…
- Detecting Voice Cloning Attacks via Timbre Watermarking — Chang Liu
In an increasingly "Ear Economy" era, where audio content is shared ubiquitously for both social and commercial purposes, the security landscape faces a critical challenge: the proliferation of…
- Eavesdropping on Black-box Mobile Devices via Audio Amplifier's EMR — Huiling Chen
In an era where digital privacy is paramount, the talk "Eavesdropping on Black-box Mobile Devices via Audio Amplifier's EMR" by Huiling Chen unveils a critical and previously underestimated…
- Compensating Removed Frequency Components: Thwarting Voice Spectrum Reduction Attacks — Shu Wang
Automatic Speech Recognition (ASR) systems have become an integral part of modern life, powering virtual assistants, dictation software, and critical content moderation platforms. However, their…
- Inaudible Adversarial Perturbation: Manipulating the Recognition of User Speech in Real Time — Xinfeng Li
This talk introduces VRIFLE, a novel inaudible adversarial perturbation (IAP) attack designed to manipulate Automatic Speech Recognition (ASR) systems in real-time, even while a user is speaking and…
- Not your Type! Detecting Storage Collision Vulnerabilities in Ethereum Smart Contracts — Nicola Ruaro
In the rapidly evolving landscape of decentralized finance (DeFi) and Ethereum smart contracts, the flexibility offered by features like contract upgradability comes with inherent security…
- Abusing the Ethereum Smart Contract Verification Services for Fun and Profit — Pengxiang Ma
In the intricate and high-stakes world of blockchain, trust is paramount, especially when billions of dollars in assets are managed by smart contracts. The integrity of these contracts hinges on a…
- Security-Performance Tradeoff in DAG-based Proof-of-Work Blockchain Protocols — Shichen Wu
This talk presents a critical re-evaluation of the security guarantees in Directed Acyclic Graph (DAG)-based Proof-of-Work (PoW) blockchain protocols, specifically focusing on Prism and OHIE. These…
- VETEOS: Statically Vetting EOSIO Contracts for the “Groundhog Day” Vulnerabilities — Levi Taiji Li
This article delves into VETEOS, a groundbreaking static analysis tool designed to uncover a unique and insidious class of vulnerabilities dubbed "Groundhog Day" attacks within EOSIO smart…
- DeepGo: Predictive Directed Greybox Fuzzing — Peihong Lin
In the realm of software security, Directed Greybox Fuzzing (DGF) has emerged as a powerful technique for efficiently identifying vulnerabilities by guiding fuzzing efforts towards specific target…
- MOCK: Optimizing Kernel Fuzzing Mutation with Context-aware Dependency — Jiacheng Xu
Modern operating system kernels are the bedrock of computing, responsible for managing hardware and software resources and providing a secure platform for applications. However, their immense…
- Predictive Context-sensitive Fuzzing — Pietro Borrello
Fuzz testing, or fuzzing, stands as a cornerstone in modern software security, invaluable for proactively identifying vulnerabilities before they can be exploited. The predominant method…
- Private Aggregate Queries to Untrusted Databases — Syed Mahbub Hafiz
In an increasingly data-driven world, the tension between data utility and user privacy is at an all-time high. Companies and malicious entities frequently exploit sensitive user data, leading to…
- Low-Quality Training Data Only? A Robust Framework for Detecting Encrypted Malicious Network Traffic — Yuqi Qing
The proliferation of encrypted network traffic, while vital for privacy and security, has created a significant blind spot for traditional intrusion detection systems. Malicious actors increasingly…
- Don't Interrupt Me - A Large-Scale Study of On-Device Permission Prompt Quieting in Chrome — Marian Harbach
This talk details a significant evolution in how Google Chrome manages user permission prompts, particularly for notifications and geolocation. Presented by Marian Harbach, the research introduces a…
- DorPatch: Distributed and Occlusion-Robust Adversarial Patch to Evade Certifiable Defenses — Chaoxiang He
Deep neural networks (DNNs) have achieved widespread success, yet they remain highly susceptible to adversarial attacks. Among these, adversarial patch attacks are particularly concerning due to…
- UniID: Spoofing Face Authentication System by Universal Identity — Zhihao Wu
This article delves into UniID: Spoofing Face Authentication System by Universal Identity, a groundbreaking work presented by Zhihao Wu at the NDSS Symposium. The talk uncovers a critical and…
- You Can Use But Cannot Recognize: Preserving Visual Privacy in Deep Neural Networks — Qiushi Li
The proliferation of Deep Neural Networks (DNNs) has ushered in an era of transformative advancements across diverse domains, from powering autonomous vehicles to revolutionizing medical…
- From Hardware Fingerprint to Access Token: Enhancing the Authentication on IoT Devices — Yue Xiao
The rapid proliferation of consumer IoT devices has underscored an urgent need for robust device authentication and access control mechanisms. Unfortunately, many resource-constrained IoT devices…
- CP-IoT: A Cross-Platform Monitoring System for Smart Home — Hai Lin
This article delves into CP-IoT, a groundbreaking cross-platform monitoring system for smart homes, presented by Hai Lin at the NDSS Symposium. The talk addresses the escalating security challenges…
- Faster and Better: Detecting Vulnerabilities in Linux-based IoT Firmware with Optimized Reaching Definition Analysis — Zicong Gao
The proliferation of Internet of Things (IoT) devices has introduced unparalleled convenience but concurrently escalated security risks. A significant portion of these risks stems from taint-style…
- The Dark Side of E-Commerce: Dropshipping Abuse as a Business Model — Arjun Arunasalam
In an era where e-commerce has become a global cornerstone of retail, experiencing a 55% surge in online spending pre-pandemic and transactions exceeding half a trillion dollars, the proliferation…
- From Interaction to Independence: zkSNARKs for Transparent and Non-Interactive Remote Attestation — Shahriar Ebrahimi
Remote Attestation (RA) is a cornerstone technology for verifying the integrity of software on remote devices, underpinning critical security protocols from secure boot to IoT security. However…
- A Security and Usability Analysis of Local Attacks Against FIDO2 — Tarun Kumar Yadav
FIDO2, a cornerstone of modern web authentication, primarily focuses on defending against remote threats like phishing and password compromise. However, a critical gap exists in its security posture…
- SLMIA-SR: Speaker-Level Membership Inference Attacks against Speaker Recognition Systems — Guangke Chen
In an era where voice data is increasingly prevalent across smart devices, social media, and various services, the privacy implications of Speaker Recognition Systems (SRSs) have become a critical…
- Crafter: Facial Feature Crafting against Inversion-based Identity Theft on Deep Models — Shiming Wang
In the rapidly evolving landscape of deep learning, the shift towards edge computing for privacy-sensitive data is becoming increasingly prevalent. This talk introduces Crafter, a novel system…
- Overconfidence is a Dangerous Thing: Mitigating Membership Inference Attacks by Enforcing Less Confident Prediction — Zitao Chen
Machine learning models, increasingly pervasive in sensitive domains from healthcare diagnostics to financial services, inherently process vast amounts of private user data. This widespread…
- CamPro: Camera-based Anti-Facial Recognition — Wenjun Zhu
The rapid advancement and pervasive deployment of deep learning-based facial recognition (FR) systems have introduced significant privacy concerns, ranging from unauthorized surveillance to…
- EM Eye: Characterizing Electromagnetic Side-channel Eavesdropping on Embedded Cameras — Yan Long
The proliferation of Internet of Things (IoT) devices and other embedded systems equipped with cameras in sensitive environments, such as homes and offices, introduces significant privacy and…
- Eavesdropping on Controller Acoustic Emanation for Keystroke Inference Attack in Virtual Reality — Shiqing Luo
Virtual Reality (VR) is rapidly evolving from a niche gaming accessory into a pervasive computing platform, boasting over 171 million users and extending its utility across diverse sectors from…
- PrintListener: Uncovering the Vulnerability of Fingerprint Authentication via the Finger Friction Sound — Man Zhou
Fingerprint authentication has become an indispensable part of modern life, securing everything from smartphones and online payments to national ID systems. However, its pervasive use also…
- SigmaDiff: Semantics-Aware Deep Graph Matching for Pseudocode Diffing — Lian Gao
In the realm of binary security analysis, precisely identifying code similarities and differences between compiled programs is a foundational yet challenging task. This talk introduces SIGMADIFF, a…
- DeGPT: Optimizing Decompiler Output with LLM — Peiwei Hu
Reverse engineering stands as a cornerstone in cybersecurity, indispensable for critical tasks such as malware analysis, vulnerability discovery, and understanding closed-source software. At its…
- DynPRE: Protocol Reverse Engineering via Dynamic Inference — Zhengxiong Luo
In the realm of network security, understanding unknown protocol specifications is a foundational yet formidable challenge. This task, known as protocol reverse engineering (PRE), is indispensable…
- Gradient Shaping: Enhancing Backdoor Attack Against Reverse Engineering — Rui Zhu
In an era where Machine Learning (ML) models are increasingly integrated into critical systems, their trustworthiness has become a paramount concern. This detailed article explores a groundbreaking…
- MASTERKEY: Automated Jailbreaking of Large Language Model Chatbots — Gelei Deng
Large Language Models (LLMs) have rapidly transformed content generation capabilities, yet they remain highly susceptible to jailbreak attacks. These sophisticated prompts are designed to bypass an…
- LMSanitator: Defending Prompt-Tuning Against Task-Agnostic Backdoors — Chengkun Wei
In the rapidly evolving landscape of large language models (LLMs), prompt-tuning has emerged as a highly efficient and scalable paradigm for adapting powerful pretrained models to diverse downstream…
- Improving the Robustness of Transformer-based Large Language Models with Dynamic Attention — Lujia Shen
Transformer-based large language models (LLMs) like BERT and GPT have revolutionized natural language processing (NLP), achieving unprecedented performance across a myriad of tasks, from text…
- DEMASQ: Unmasking the ChatGPT Wordsmith — Kavita Kumari
The proliferation of Large Language Models (LLMs) like ChatGPT has ushered in a new era of content generation, but with it, a critical challenge: the inability to reliably distinguish between…
- IDA: Hybrid Attestation with Support for Interrupts and TOCTOU — Fatemeh Arkannezhad
In an era dominated by smart and embedded IoT devices, ensuring the integrity and trustworthiness of their software state is paramount. These devices, ranging from manufacturing equipment to…
- LoRDMA: A New Low-Rate DoS Attack in RDMA Networks — Shicheng Wang
The proliferation of Remote Direct Memory Access (RDMA) from private data centers into multi-tenant cloud environments has ushered in unprecedented performance benefits, primarily by enabling direct…
- PriSrv: Privacy-Enhanced and Highly Usable Service Discovery in Wireless Communications — Yang Yang
Service discovery protocols are the invisible backbone of modern wireless communications, enabling devices to locate and interact with services seamlessly. From connecting to Wi-Fi networks and…
- NODLINK: An Online System for Fine-Grained APT Attack Detection and Investigation — Shaofei Li
Advanced Persistent Threats (APT attacks) pose a significant and costly challenge to modern enterprises, often characterized by their multi-stage, stealthy, and complex nature. Traditional Endpoint…
- REPLICAWATCHER: Training-less Anomaly Detection in Containerized Microservices — Asbat El Khairi
In the rapidly evolving landscape of containerized microservices, traditional anomaly detection systems face a formidable challenge: the relentless shift in what constitutes "normal" behavior. This…
- TALISMAN: Tamper Analysis for Reference Monitors — Frank Capobianco
In this presentation, Frank Capobianco introduced TALISMAN, an automated analysis tool designed to detect subtle yet critical flaws that can compromise the tamper-proofing of reference monitor…
- BliMe: Verifiably Secure Outsourced Computation with Hardware-Enforced Taint Tracking — Hossam ElAtali
The proliferation of outsourced computing, driven by its undeniable cost benefits and scalability, has introduced a fundamental challenge: maintaining the confidentiality of sensitive client data…
- Efficient Use-After-Free Prevention with Opportunistic Page-Level Sweeping — Chanyoung Park
In this insightful talk, Chanyoung Park introduced HUSHVAC, a novel and highly efficient approach to preventing use-after-free (UAF) vulnerabilities in software utilizing manual memory management…
- GhostType: The Limits of Using Contactless Electromagnetic Interference to Inject Phantom Keys into Analog Circuits of Keyboards — Qinhong Jiang
In a groundbreaking presentation at NDSS 2024, Qinhong Jiang unveiled "GhostType," a novel attack demonstrating the pervasive vulnerability of modern keyboards to contactless electromagnetic…
- LiDAR Spoofing Meets the New-Gen: Capability Improvements, Broken Assumptions, and New Attack Strategies — Takami Sato
LiDAR (Light Detection And Ranging) technology stands as a cornerstone for precise, long-range 3D sensing, critically enabling the rapid advancement and deployment of autonomous driving (AD)…
- Invisible Reflections: Leveraging Infrared Laser Reflections to Target Traffic Sign Perception — Takami Sato
This talk introduces a groundbreaking and concerning vulnerability for Connected Autonomous Vehicles (CAVs): the Infrared Laser Reflection (ILR) attack. Presented by Takami Sato, this research…
- MadRadar: A Black-Box Physical Layer Attack Framework on mmWave Automotive FMCW Radars — David Hunt
In this presentation, David Hunt unveiled MadRadar, a groundbreaking black-box physical layer attack framework designed to target millimeter-wave (mmWave) automotive Frequency Modulated Continuous…
- Untangle: Multi-Layer Web Server Fingerprinting — Cem Topcuoglu
In the modern web landscape, sophisticated web applications are rarely deployed as monolithic, single-server entities. Instead, they commonly reside behind complex, multi-layered architectures…
- Certificate Transparency Revisited: The Public Inspections on Third-party Monitors — Aozhuo Sun
The integrity of the modern web relies heavily on TLS certificates, which vouch for the authenticity of websites and secure communication. However, the ecosystem built on trust in Certification…
- Compromising Industrial Processes using Web-Based Programmable Logic Controller Malware — Ryan Pickren
This article delves into a groundbreaking security talk presented by Ryan Pickren, which introduces a novel and highly effective method for developing Programmable Logic Controller (PLC) malware…
- TrustSketch: Trustworthy Sketch-based Telemetry on Cloud Hosts — Zhuo Cheng
In the dynamic landscape of cloud computing, network telemetry forms the backbone of critical management functions such as anomaly detection, precise billing, and efficient traffic engineering…
- Transpose Attack: Stealing Datasets with Bidirectional Training — Guy Amit
In an era where Artificial Intelligence (AI) underpins critical infrastructure and services, the integrity and confidentiality of training data for Deep Neural Networks (DNNs) have become paramount…
- Sneaky Spikes: Uncovering Stealthy Backdoor Attacks in Spiking Neural Networks with Neuromorphic Data — Gorka Abad
Deep Neural Networks (DNNs) have revolutionized machine learning, yet their computational demands and energy consumption pose significant challenges, particularly for resource-constrained…
- GraphGuard: Detecting and Counteracting Training Data Misuse in Graph Neural Networks — Bang Wu
Graph Neural Networks (GNNs) have emerged as a transformative technology for analyzing complex graph-structured data across diverse fields, from e-Commerce recommendations to advanced drug discovery…
- Enhance Stealthiness and Transferability of Adversarial Attacks with Class Activation Mapping Ensemble Attack — Hui Xia
This talk introduces the Class Activation Mapping Ensemble Attack (CAM-EA), a novel adversarial attack method designed to significantly enhance the stealthiness and transferability of adversarial…
- A Duty to Forget, a Right to be Assured? Exposing Vulnerabilities in Machine Unlearning Services — Hongsheng Hu
This talk, presented by Hongsheng Hu at the NDSS Symposium, delves into a critical and emerging security challenge within Machine Learning as a Service (MLaaS) environments: the vulnerability of…
- Pencil: Private and Extensible Collaborative Learning without the Non-Colluding Assumption — Xuanqi Liu
This article delves into "Pencil," a groundbreaking framework for collaborative machine learning that addresses critical challenges in data privacy, model confidentiality, and system extensibility…
- SSL-WM: A Black-Box Watermarking Approach for Encoders Pre-trained by Self-Supervised Learning — Peizhuo Lv
Self-Supervised Learning (SSL) has revolutionized fields like Computer Vision (CV) and Natural Language Processing (NLP), enabling the creation of powerful, general-purpose encoders capable of…