Network and Distributed System Security (NDSS) Symposium 2024
The 31st annual NDSS Symposium, a top-tier academic security conference hosted by the Internet Society, featuring 140 peer-reviewed papers on network and distributed system security.
→ See editor’s top picks at Network and Distributed System Security (NDSS) Symposium 2024
- Decentralized Information-Flow Control for ROS2 — Nishit V. Pandya
This article delves into Picaros, a novel system for **Decentralized Information-Flow Control (DIFC)** specifically designed for **ROS2 (Robot Operating System 2)**. Presented by Nishit V. Pandya…
- Facilitating Non-Intrusive In-Vivo Firmware Testing with Stateless Instrumentation — Jiameng Shi
Dynamic testing techniques, ubiquitous in general software development, face formidable challenges when applied to firmware on deeply embedded devices like microcontrollers (MCUs). These devices…
- LDR: Secure and Efficient Linux Driver Runtime for Embedded TEE Systems — Huaiyu Yan
This talk introduces the Linux Driver Runtime, or **LDR**, a novel execution environment designed to bring robust, secure, and efficient device driver support to **Trusted Execution Environments…
- Content Censorship in the InterPlanetary File System — Srivatsan Sridhar
The InterPlanetary File System (**IPFS**) stands as the largest decentralized storage solution globally, underpinning thousands of participants and facilitating millions of daily content transfers…
- On Precisely Detecting Censorship Circumvention in Real-World Networks — Ryan Wails
This talk, presented by Ryan Wails at the NDSS Symposium, addresses a critical and often underestimated challenge in the cat-and-mouse game of internet censorship: the precise detection of…
- Modeling and Detecting Internet Censorship Events — Elisa Tsai
In an era where internet freedom is increasingly challenged, understanding and detecting censorship events is paramount for human rights organizations, journalists, and researchers. However, the…
- Efficient and Timely Revocation of V2X Credentials — Gianluca Scopelliti
In the rapidly evolving landscape of Intelligent Transport Systems (ITS), the security and trustworthiness of Vehicle-to-Everything (V2X) communication are paramount for ensuring road safety and…
- Towards Precise Reporting of Cryptographic Misuses — Yikang Chen
Modern software relies heavily on cryptographic Application Programming Interfaces (APIs) to secure data and communications. However, developers frequently misuse these complex APIs, leading to…
- A Unified Symbolic Analysis of WireGuard — Pascal Lafourcade
This talk presents a groundbreaking, unified symbolic analysis of the **WireGuard** protocol, a modern VPN solution rapidly gaining adoption due to its simplicity and robustness. Given by Pascal…
- ReqsMiner: Automated Discovery of CDN Forwarding Request Inconsistencies and DoS Attacks with Grammar-based Fuzzing — Linkai Zheng
Content Delivery Networks (CDNs) are fundamental components of modern internet infrastructure, crucial for accelerating content delivery and providing robust security against various online threats…
- Large Language Model guided Protocol Fuzzing — Ruijie Meng
This article delves into "Large Language Model guided Protocol Fuzzing," a groundbreaking approach presented at the NDSS Symposium. The talk, delivered by Ruijie Meng, addresses a critical and…
- ShapFuzz: Efficient Fuzzing via Shapley-Guided Byte Selection — Kunpeng Zhang
Mutation-based fuzzing stands as a critical technique in the arsenal of vulnerability researchers, instrumental in uncovering software bugs and exploring uncharted code paths. Despite its widespread…
- Flow Correlation Attacks on Tor Onion Service Sessions with Sliding Subset Sum — Daniela Lopes
In a significant presentation at the NDSS Symposium, Daniela Lopes unveiled SUMo, a novel and highly effective **flow correlation attack** specifically engineered to deanonymize Tor onion service…
- MirageFlow: A New Bandwidth Inflation Attack on Tor — Christoph Sendner
In a critical presentation at the NDSS Symposium, Christoph Sendner unveiled "MirageFlow," a novel and potent **bandwidth inflation attack** that poses a significant threat to the **Tor** network's…
- LARMix: Latency-Aware Routing in Mix Networks — Mahdi Rahimi
Anonymous communication systems, such as **mix networks**, are vital tools for preserving user privacy online. However, their core mechanism of reordering and delaying messages to achieve anonymity…
- The CURE to Vulnerabilities in RPKI Validation — Donika Mirdita
The Border Gateway Protocol (BGP), the foundational routing protocol of the Internet, faces a critical and persistent vulnerability: route hijacks. Due to BGP's inherent trust model, any router can…
- dRR: A Decentralized, Scalable, and Auditable Architecture for RPKI Repository — Yingying Su
The talk introduces **dRR**, a novel architecture designed to fortify the Resource Public Key Infrastructure (RPKI) Repository, a critical element for securing inter-domain routing and preventing IP…
- IRRedicator: Pruning IRR with RPKI-Valid BGP Insights — Minhyeok Kang
The Internet's routing infrastructure, underpinned by the Border Gateway Protocol (BGP), faces persistent security vulnerabilities due to its foundational design prioritizing stability over…
- Proof of Backhaul: Trustfree Measurement of Broadband Bandwidth — Peiyao Sheng
The talk "Proof of Backhaul: Trustfree Measurement of Broadband Bandwidth" by Peiyao Sheng introduces a groundbreaking protocol designed to securely and transparently measure the broadband backhaul…
- Understanding the Implementation and Security Implications of Protective DNS Services — Mingxuan Liu
The internet's utility is constantly challenged by the proliferation of malicious domain names, which serve as critical infrastructure for cyberattacks such as botnet command and control, phishing…
- BGP-iSec: Improved Security of Internet Routing Against Post-ROV Attacks — Cameron Morris
The Border Gateway Protocol (BGP) has been the foundational routing protocol for the internet for decades, yet its inherent security vulnerabilities have been a persistent concern since its…
- Symphony: Path Validation at Scale — Anxiao He
In this presentation at the NDSS Symposium, Anxiao He introduced "Symphony: Path Validation at Scale," a groundbreaking work addressing a fundamental security challenge in future Internet…
- Beyond the Surface: Uncovering the Unprotected Components of Android Against Overlay Attack — Hao Zhou
The Android operating system, renowned for its flexibility and user experience, incorporates a powerful feature known as **overlays** or **floating windows**. This functionality allows applications…
- 50 Shades of Support: A Device-Centric Analysis of Android Security Updates — Abbas Acar
Android, the world's most popular mobile operating system with over three billion active devices, faces a persistent challenge in delivering timely and consistent security updates to its vast user…
- QUACK: Hindering Deserialization Attacks via Static Duck Typing — Yaniv David
Deserialization vulnerabilities represent a pervasive and critical threat in modern software development, consistently ranking among the **OWASP Top 10** for web application security risks…
- Automatic Policy Synthesis and Enforcement for Protecting Untrusted Deserialization — Quan Zhang
Java deserialization vulnerabilities represent a persistent and critical security threat to modern applications. Attackers exploit these flaws by injecting meticulously crafted malicious objects…
- FP-Fed: Privacy-Preserving Federated Detection of Browser Fingerprinting — Meenatchi Sundaram Muthu Selva Annamalai
This article delves into FP-Fed, a groundbreaking system designed for the **Privacy-Preserving Federated Detection of Browser Fingerprinting**. Presented at the NDSS Symposium by Meenatchi Sundaram…
- CrowdGuard: Federated Backdoor Detection in Federated Learning — Phillip Rieger
CrowdGuard introduces a pioneering defense mechanism designed to robustly detect and mitigate backdoor attacks within Federated Learning (FL) environments. Presented by Phillip Rieger, this talk…
- Automatic Adversarial Adaption for Stealthy Poisoning Attacks in Federated Learning — Torsten Krauß
Federated Learning (FL) has emerged as a transformative paradigm for collaboratively training machine learning models across distributed datasets, offering compelling advantages in data privacy…
- FreqFed: A Frequency Analysis-Based Approach for Mitigating Poisoning Attacks in Federated Learning — Hossein Fereidooni
Federated Learning (FL) has emerged as a crucial paradigm for collaborative machine learning, enabling multiple clients to jointly train a global model without sharing their sensitive local data…
- Acoustic Keystroke Leakage on Smart Televisions — Tejas Kannan
This talk, presented by Tejas Kannan at the NDSS Symposium, uncovers a novel acoustic side-channel attack targeting the virtual keyboards of popular Smart Televisions (Smart TVs). With projections…
- IdleLeak: Exploiting Idle State Side Effects for Information Leakage — Fabian Rauscher
Fabian Rauscher's presentation at the NDSS Symposium unveils **IdleLeak**, a novel side-channel attack that exploits previously unexplored behaviors of modern CPU idle states. Modern processors…
- TEE-SHirT: Scalable Leakage-Free Cache Hierarchies for TEEs — Kerem Arikan
The talk "TEE-SHirT: Scalable Leakage-Free Cache Hierarchies for TEEs," presented by Kerem Arikan at the NDSS Symposium, addresses a fundamental and persistent challenge in secure computing…
- Exploiting Sequence Number Leakage: TCP Hijacking in NAT-Enabled Wi-Fi Networks — Yuxiang Yang
This talk, presented by Yuxiang Yang at the NDSS Symposium, uncovers a novel and potent off-path TCP hijacking attack targeting Wi-Fi networks that employ Network Address Translation (NAT). The…
- GNNIC: Finding Long-Lost Sibling Functions with Abstract Similarity — Qiushi Wu
The talk "GNNIC: Finding Long-Lost Sibling Functions with Abstract Similarity," presented by Qiushi Wu at the NDSS Symposium, addresses a pervasive and critical challenge in program analysis: the…
- Group-based Robustness: A General Framework for Customized Robustness in the Real World — Weiran Lin
In an era where machine learning models are increasingly integrated into critical real-world applications, their vulnerability to sophisticated evasion attacks poses a significant threat. Weiran…
- Experimental Analyses of the Physical Surveillance Risks in Client-Side Content Scanning — Ashish Hooda
The proliferation of end-to-end encryption (E2EE) in digital communication platforms, while a boon for user privacy, has presented a significant challenge for detecting and mitigating the spread of…
- Timing Channels in Adaptive Neural Networks — Ayomide Akinsanya
Modern deep neural networks (DNNs) have revolutionized various fields with their impressive predictive capabilities, yet they often demand substantial computational resources. This challenge has…
- AnonPSI: An Anonymity Assessment Framework for PSI — Bo Jiang
This talk introduces AnonPSI, a comprehensive framework designed for assessing the anonymity and privacy leakage of Private Set Intersection (PSI) protocols. PSI is a foundational cryptographic…
- Unus pro omnibus: Multi-Client Searchable Encryption via Access Control — Jiafan Wang
This article delves into "Unus pro omnibus: Multi-Client Searchable Encryption via Access Control," a talk presented by Jiafan Wang at the NDSS Symposium. The core focus of this research is to…
- Pisces: Private and Compliable Cryptocurrency Exchange — Ya-Nan Li
"Pisces: Private and Compliable Cryptocurrency Exchange" introduces a groundbreaking system designed to address a critical privacy vulnerability inherent in modern centralized cryptocurrency…
- Secret-Shared Shuffle with Malicious Security — Xiangfu Song
This article delves into the critical advancements presented in the talk "Secret-Shared Shuffle with Malicious Security." **Secret-Shared Shuffle (SSS)** protocols are foundational primitives within…
- SENSE: Enhancing Microarchitectural Awareness for TEEs via Subscription-Based Notification — Fan Sang
Trusted Execution Environments (TEEs) are critical for securing sensitive computations, but they face a persistent and formidable adversary in **side-channel attacks (SCAs)**. Despite continuous…
- EnclaveFuzz: Finding Vulnerabilities in SGX Applications — Liheng Chen
Intel's Software Guard Extensions (SGX) provides a robust hardware-isolated execution environment, known as an **enclave**, designed to protect sensitive code and data from a potentially malicious…
- Faults in Our Bus: Novel Bus Fault Attack to Break ARM TrustZone — Nimish Mishra
The proliferation of Internet of Things (IoT) devices, often powered by complex, high-frequency Systems-on-a-Chip (SoCs), presents a significant security challenge. With billions of connected…
- Parrot-Trained Adversarial Examples: Pushing the Practicality of Black-Box Audio Attacks against Speaker Recognition Models — Rui Duan
Speaker recognition systems, ubiquitous in smart devices and security applications, face a significant and evolving threat from **audio adversarial examples (AEs)**. While advancements in black-box…
- Attributions for ML-based ICS Anomaly Detection: From Theory to Practice — Clement Fung
Industrial Control Systems (ICS) form the bedrock of critical infrastructure, orchestrating vital processes from power generation to water treatment. The integrity of these systems is paramount, as…
- TextGuard: Provable Defense against Backdoor Attacks on Text Classification — Hengzhi Pei
In an era increasingly reliant on machine learning models for critical applications, the integrity and trustworthiness of these systems are paramount. This article delves into TextGuard, a…
- When Cryptography Needs a Hand: Practical Post-Quantum Authentication for V2V Communications — Geoff Twardokus
This talk, "When Cryptography Needs a Hand: Practical Post-Quantum Authentication for V2V Communications," presented by Geoff Twardokus, addresses the critical and immediate threat quantum computing…
- HEIR: A Unified Representation for Cross-Scheme Compilation of Fully Homomorphic Computation — Song Bian
Fully Homomorphic Encryption (FHE) stands as a cornerstone of secure multi-party computation, enabling computations on encrypted data without ever decrypting it. This powerful cryptographic…
- Powers of Tau in Asynchrony — Sourav Das
Sourav Das’s talk, "Powers of Tau in Asynchrony," introduces a groundbreaking distributed protocol for securely and robustly generating **q-Strong Diffie-Hellman (q-SDH)** parameters in an…
- Scrappy: SeCure Rate Assuring Protocol with PrivacY — Kosei Akama
The internet’s reliance on online services has brought with it an escalating challenge: how to mitigate abusive activities without compromising user privacy or degrading the user experience…
- Information Based Heavy Hitters for Real-Time DNS Data Exfiltration Detection — Yarin Ozery
Data exfiltration over the Domain Name System (DNS) protocol remains a persistent and significant cybersecurity threat. Malicious actors, ranging from state-sponsored groups to ransomware operators…
- BreakSPF: How Shared Infrastructures Magnify SPF Vulnerabilities Across the Internet — Chuhan Wang
Email spoofing remains a pervasive and dangerous threat, enabling attackers to impersonate legitimate senders for phishing, spam, and fraud. The **Sender Policy Framework (SPF)** is a foundational…
- Understanding Route Origin Validation (ROV) Deployment in the Real World and Why MANRS Action 1 Is Not Followed — Lancheng Qin
BGP hijacking remains a persistent and critical threat to the stability and security of the global Internet routing system. In 2021 alone, BGPStream reported a staggering 775 hijacking incidents…
- UntrustIDE: Exploiting Weaknesses in VS Code Extensions — Elizabeth Lin
In an era where the software supply chain faces relentless attack, developer Integrated Development Environments (IDEs) have emerged as a critical, yet often overlooked, target. The talk…
- SyzBridge: Bridging the Gap in Exploitability Assessment of Linux Kernel Bugs in the Linux Ecosystem — Xiaochen Zou
Continuous fuzzing, exemplified by platforms like **syzbot**, has become an indispensable component of the Linux kernel development ecosystem, successfully unearthing thousands of bugs. However, a…
- File Hijacking Vulnerability: The Elephant in the Room — Chendong Yu
In this NDSS Symposium talk, Chendong Yu presented "File Hijacking Vulnerability: The Elephant in the Room," a comprehensive analysis of **File Hijacking Vulnerabilities (FHVulns)**. FHVulns…
- Phoenix: Surviving Unpatched Vulnerabilities via Accurate and Efficient Filtering of Syscall Sequences — Hugo Kermabon-Bobinnec
The digital landscape is relentlessly challenged by unpatched vulnerabilities, posing a severe dilemma for businesses: risk exposure by keeping vulnerable services online or incur significant…
- CAGE: Complementing Arm CCA with GPU Extensions — Chenxu Wang
Confidential computing stands as a cornerstone in modern data security, promising isolated and transparent execution environments that shield sensitive data from a spectrum of threats, including…
- Architecting Trigger-Action Platforms for Security, Performance and Functionality — Deepak Sirone Jegan
Trigger-Action Platforms (TAPs) like IFTTT, Zapier, and Microsoft Power Automate have become indispensable tools for end-users, enabling seamless automation of interactions between diverse web…
- Understanding and Analyzing Appraisal Systems in the Underground Marketplaces — Zhengyi Li
This talk, presented by Zhengyi Li at the NDSS Symposium, delves into the burgeoning phenomenon of **appraisal systems** within underground online marketplaces. These illicit platforms, much like…
- Like, Comment, Get Scammed: Characterizing Comment Scams on Media Platforms — Xigao Li
In an era dominated by vast digital media platforms like YouTube, the sheer volume of user engagement creates fertile ground for cybercriminals. This talk, "Like, Comment, Get Scammed…
- Front-running Attack in Sharded Blockchains and Fair Cross-shard Consensus — Jianting Zhang
This talk by Jianting Zhang from the NDSS Symposium unveils a critical, previously unaddressed security vulnerability in **sharded blockchains**: a novel form of **front-running attack** that…
- A Two-Layer Blockchain Sharding Protocol Leveraging Safety and Liveness for Enhanced Performance — Yibin Xu
Blockchain technology has ushered in a new era of decentralized applications, but its widespread adoption is often hindered by inherent scalability limitations. The challenge lies in processing a…
- Secure Multiparty Computation of Threshold Signatures Made More Efficient — Harry W. H. Wong
This article delves into Harry W. H. Wong's presentation on enhancing the efficiency of secure multiparty computation (SMC) for **threshold signatures**, a critical cryptographic primitive for…
- Separation is Good: A Faster Order-Fairness Byzantine Consensus — Ke Mu
This article delves into SpeedyFair, a novel high-performance Byzantine Fault-Tolerant (BFT) consensus protocol designed to address the pervasive problem of adversarial transaction order…
- ORL-AUDITOR: Dataset Auditing in Offline Deep Reinforcement Learning — Linkang Du
In the rapidly evolving landscape of artificial intelligence, **Deep Reinforcement Learning (DRL)** has emerged as a transformative paradigm, driving innovation across complex decision-making…
- DRAINCLoG: Detecting Rogue Accounts with Illegally-obtained NFTs using Classifiers Learned on Graphs — Hanna Kim
This article delves into DRAINCLoG, a groundbreaking research initiative presented at the NDSS Symposium, focused on combating the escalating threat of **NFT drainers** within the Non-Fungible Token…
- MPCDiff: Testing and Repairing MPC-Hardened Deep Learning Models — Qi Pang
Secure Multi-Party Computation (MPC) has emerged as a foundational technology for privacy-preserving machine learning, enabling multiple entities to collaboratively execute computations on sensitive…
- K-LEAK: Towards Automating the Generation of Multi-Step Infoleak Exploits against the Linux Kernel — Zhengchuan Liang
The security of the operating system kernel is paramount, as it forms the trusted computing base for all modern systems. Despite continuous efforts, memory errors such as **out-of-bounds (OOB)** and…
- Sharing cyber threat intelligence: Does it really help? — Beomjin Jin
In an era of relentlessly escalating cyber threats, the effective sharing of Cyber Threat Intelligence (CTI) is paramount for robust security postures. Beomjin Jin's talk, "Sharing cyber threat…
- Bernoulli Honeywords — Ke Coby Wang
Ke Coby Wang's presentation on "Bernoulli Honeywords" at the NDSS Symposium introduces a groundbreaking methodology for the proactive detection of credential database breaches. This work directly…
- Towards Automated Regulation Analysis for Effective Privacy Compliance — Sunil Manandhar
In a world increasingly shaped by digital interactions, the proliferation of privacy and data protection regulations presents a formidable challenge for businesses and researchers alike. Sunil…
- ActiveDaemon: Unconscious DNN Dormancy and Waking Up via User-specific Invisible Token — Ge Ren
Deep Neural Networks (DNNs) have become indispensable assets in modern commerce, powering everything from natural language processing to advanced content generation. However, the substantial…
- Maginot Line: Assessing a New Cross-app Threat to PII-as-Factor Authentication in Chinese Mobile Apps — Fannv He
In the rapidly evolving landscape of mobile application security, especially within the vast Chinese digital ecosystem, the reliance on Personally Identifiable Information (PII) as an authentication…
- AAKA: An Anti-Tracking Cellular Authentication Scheme Leveraging Anonymous Credentials — Hexuan Yu
The talk introduces **AAKA**, a novel Anti-Tracking Cellular Authentication Scheme designed to address the persistent privacy concern of mobile tracking by Mobile Network Operators (MNOs). MNOs…
- 5G-Spector: An O-RAN Compliant Layer-3 Cellular Attack Detection Service — Haohuang Wen
In the rapidly evolving landscape of 5G mobile networks, the transition to **Open Radio Access Network (O-RAN)** architecture presents both unprecedented opportunities and significant security…
- Leaking the Privacy of Groups and More: Understanding Privacy Risks of Cross-App Content Sharing in Mobile Ecosystem — Jiangrong Wu
Cross-app content sharing, or **Cracs**, is a pervasive feature in modern mobile applications, enabling users to effortlessly share content like videos or articles between different platforms. While…
- Detecting Voice Cloning Attacks via Timbre Watermarking — Chang Liu
In an increasingly "Ear Economy" era, where audio content is shared ubiquitously for both social and commercial purposes, the security landscape faces a critical challenge: the proliferation of…
- Eavesdropping on Black-box Mobile Devices via Audio Amplifier's EMR — Huiling Chen
In an era where digital privacy is paramount, the talk "Eavesdropping on Black-box Mobile Devices via Audio Amplifier's EMR" by Huiling Chen unveils a critical and previously underestimated…
- Compensating Removed Frequency Components: Thwarting Voice Spectrum Reduction Attacks — Shu Wang
Automatic Speech Recognition (ASR) systems have become an integral part of modern life, powering virtual assistants, dictation software, and critical content moderation platforms. However, their…
- Inaudible Adversarial Perturbation: Manipulating the Recognition of User Speech in Real Time — Xinfeng Li
This talk introduces **VRIFLE**, a novel **inaudible adversarial perturbation (IAP) attack** designed to manipulate **Automatic Speech Recognition (ASR)** systems in real-time, even while a user is…
- Not your Type! Detecting Storage Collision Vulnerabilities in Ethereum Smart Contracts — Nicola Ruaro
In the rapidly evolving landscape of decentralized finance (DeFi) and Ethereum smart contracts, the flexibility offered by features like contract upgradability comes with inherent security…
- Abusing the Ethereum Smart Contract Verification Services for Fun and Profit — Pengxiang Ma
In the intricate and high-stakes world of blockchain, trust is paramount, especially when billions of dollars in assets are managed by **smart contracts**. The integrity of these contracts hinges on…
- Security-Performance Tradeoff in DAG-based Proof-of-Work Blockchain Protocols — Shichen Wu
This talk presents a critical re-evaluation of the security guarantees in Directed Acyclic Graph (DAG)-based Proof-of-Work (PoW) blockchain protocols, specifically focusing on Prism and OHIE. These…
- VETEOS: Statically Vetting EOSIO Contracts for the “Groundhog Day” Vulnerabilities — Levi Taiji Li
This article delves into VETEOS, a groundbreaking static analysis tool designed to uncover a unique and insidious class of vulnerabilities dubbed "Groundhog Day" attacks within EOSIO smart…
- DeepGo: Predictive Directed Greybox Fuzzing — Peihong Lin
In the realm of software security, **Directed Greybox Fuzzing (DGF)** has emerged as a powerful technique for efficiently identifying vulnerabilities by guiding fuzzing efforts towards specific…
- MOCK: Optimizing Kernel Fuzzing Mutation with Context-aware Dependency — Jiacheng Xu
Modern operating system **kernels** are the bedrock of computing, responsible for managing hardware and software resources and providing a secure platform for applications. However, their immense…
- Predictive Context-sensitive Fuzzing — Pietro Borrello
Fuzz testing, or fuzzing, stands as a cornerstone in modern software security, invaluable for proactively identifying vulnerabilities before they can be exploited. The predominant method…
- Private Aggregate Queries to Untrusted Databases — Syed Mahbub Hafiz
In an increasingly data-driven world, the tension between data utility and user privacy is at an all-time high. Companies and malicious entities frequently exploit sensitive user data, leading to…
- Low-Quality Training Data Only? A Robust Framework for Detecting Encrypted Malicious Network Traffic — Yuqi Qing
The proliferation of encrypted network traffic, while vital for privacy and security, has created a significant blind spot for traditional intrusion detection systems. Malicious actors increasingly…
- Don't Interrupt Me - A Large-Scale Study of On-Device Permission Prompt Quieting in Chrome — Marian Harbach
This talk details a significant evolution in how Google Chrome manages user permission prompts, particularly for notifications and geolocation. Presented by Marian Harbach, the research introduces a…
- DorPatch: Distributed and Occlusion-Robust Adversarial Patch to Evade Certifiable Defenses — Chaoxiang He
Deep neural networks (DNNs) have achieved widespread success, yet they remain highly susceptible to adversarial attacks. Among these, **adversarial patch attacks** are particularly concerning due to…
- UniID: Spoofing Face Authentication System by Universal Identity — Zhihao Wu
This article delves into UniID: Spoofing Face Authentication System by Universal Identity, a groundbreaking work presented by Zhihao Wu at the NDSS Symposium. The talk uncovers a critical and…
- You Can Use But Cannot Recognize: Preserving Visual Privacy in Deep Neural Networks — Qiushi Li
The proliferation of **Deep Neural Networks (DNNs)** has ushered in an era of transformative advancements across diverse domains, from powering autonomous vehicles to revolutionizing medical…
- From Hardware Fingerprint to Access Token: Enhancing the Authentication on IoT Devices — Yue Xiao
The rapid proliferation of consumer IoT devices has underscored an urgent need for robust device authentication and access control mechanisms. Unfortunately, many resource-constrained IoT devices…
- CP-IoT: A Cross-Platform Monitoring System for Smart Home — Hai Lin
This article delves into CP-IoT, a groundbreaking cross-platform monitoring system for smart homes, presented by Hai Lin at the NDSS Symposium. The talk addresses the escalating security challenges…
- Faster and Better: Detecting Vulnerabilities in Linux-based IoT Firmware with Optimized Reaching Definition Analysis — Zicong Gao
The proliferation of **Internet of Things (IoT)** devices has introduced unparalleled convenience but concurrently escalated security risks. A significant portion of these risks stems from…
- The Dark Side of E-Commerce: Dropshipping Abuse as a Business Model — Arjun Arunasalam
In an era where e-commerce has become a global cornerstone of retail, experiencing a 55% surge in online spending pre-pandemic and transactions exceeding half a trillion dollars, the proliferation…
- From Interaction to Independence: zkSNARKs for Transparent and Non-Interactive Remote Attestation — Shahriar Ebrahimi
Remote Attestation (RA) is a cornerstone technology for verifying the integrity of software on remote devices, underpinning critical security protocols from secure boot to IoT security. However…
- A Security and Usability Analysis of Local Attacks Against FIDO2 — Tarun Kumar Yadav
FIDO2, a cornerstone of modern web authentication, primarily focuses on defending against remote threats like phishing and password compromise. However, a critical gap exists in its security posture…
- SLMIA-SR: Speaker-Level Membership Inference Attacks against Speaker Recognition Systems — Guangke Chen
In an era where voice data is increasingly prevalent across smart devices, social media, and various services, the privacy implications of **Speaker Recognition Systems** (SRSs) have become a…
- Crafter: Facial Feature Crafting against Inversion-based Identity Theft on Deep Models — Shiming Wang
In the rapidly evolving landscape of deep learning, the shift towards edge computing for privacy-sensitive data is becoming increasingly prevalent. This talk introduces **Crafter**, a novel system…
- Overconfidence is a Dangerous Thing: Mitigating Membership Inference Attacks by Enforcing Less Confident Prediction — Zitao Chen
Machine learning models, increasingly pervasive in sensitive domains from healthcare diagnostics to financial services, inherently process vast amounts of private user data. This widespread…
- CamPro: Camera-based Anti-Facial Recognition — Wenjun Zhu
The rapid advancement and pervasive deployment of deep learning-based facial recognition (FR) systems have introduced significant privacy concerns, ranging from unauthorized surveillance to…
- EM Eye: Characterizing Electromagnetic Side-channel Eavesdropping on Embedded Cameras — Yan Long
The proliferation of Internet of Things (IoT) devices and other embedded systems equipped with cameras in sensitive environments, such as homes and offices, introduces significant privacy and…
- Eavesdropping on Controller Acoustic Emanation for Keystroke Inference Attack in Virtual Reality — Shiqing Luo
Virtual Reality (VR) is rapidly evolving from a niche gaming accessory into a pervasive computing platform, boasting over 171 million users and extending its utility across diverse sectors from…
- PrintListener: Uncovering the Vulnerability of Fingerprint Authentication via the Finger Friction Sound — Man Zhou
Fingerprint authentication has become an indispensable part of modern life, securing everything from smartphones and online payments to national ID systems. However, its pervasive use also…
- SigmaDiff: Semantics-Aware Deep Graph Matching for Pseudocode Diffing — Lian Gao
In the realm of binary security analysis, precisely identifying code similarities and differences between compiled programs is a foundational yet challenging task. This talk introduces SIGMADIFF, a…
- DeGPT: Optimizing Decompiler Output with LLM — Peiwei Hu
Reverse engineering stands as a cornerstone in cybersecurity, indispensable for critical tasks such as malware analysis, vulnerability discovery, and understanding closed-source software. At its…
- DynPRE: Protocol Reverse Engineering via Dynamic Inference — Zhengxiong Luo
In the realm of network security, understanding unknown protocol specifications is a foundational yet formidable challenge. This task, known as **protocol reverse engineering (PRE)**, is…
- Gradient Shaping: Enhancing Backdoor Attack Against Reverse Engineering — Rui Zhu
In an era where Machine Learning (ML) models are increasingly integrated into critical systems, their trustworthiness has become a paramount concern. This detailed article explores a groundbreaking…
- MASTERKEY: Automated Jailbreaking of Large Language Model Chatbots — Gelei Deng
Large Language Models (LLMs) have rapidly transformed content generation capabilities, yet they remain highly susceptible to **jailbreak attacks**. These sophisticated prompts are designed to bypass…
- LMSanitator: Defending Prompt-Tuning Against Task-Agnostic Backdoors — Chengkun Wei
In the rapidly evolving landscape of large language models (LLMs), **prompt-tuning** has emerged as a highly efficient and scalable paradigm for adapting powerful pretrained models to diverse…
- Improving the Robustness of Transformer-based Large Language Models with Dynamic Attention — Lujia Shen
Transformer-based large language models (LLMs) like BERT and GPT have revolutionized natural language processing (NLP), achieving unprecedented performance across a myriad of tasks, from text…
- DEMASQ: Unmasking the ChatGPT Wordsmith — Kavita Kumari
The proliferation of Large Language Models (LLMs) like ChatGPT has ushered in a new era of content generation, but with it, a critical challenge: the inability to reliably distinguish between…
- IDA: Hybrid Attestation with Support for Interrupts and TOCTOU — Fatemeh Arkannezhad
In an era dominated by smart and embedded **IoT devices**, ensuring the integrity and trustworthiness of their software state is paramount. These devices, ranging from manufacturing equipment to…
- LoRDMA: A New Low-Rate DoS Attack in RDMA Networks — Shicheng Wang
The proliferation of Remote Direct Memory Access (RDMA) from private data centers into multi-tenant cloud environments has ushered in unprecedented performance benefits, primarily by enabling direct…
- PriSrv: Privacy-Enhanced and Highly Usable Service Discovery in Wireless Communications — Yang Yang
Service discovery protocols are the invisible backbone of modern wireless communications, enabling devices to locate and interact with services seamlessly. From connecting to Wi-Fi networks and…
- NODLINK: An Online System for Fine-Grained APT Attack Detection and Investigation — Shaofei Li
Advanced Persistent Threats (**APT** attacks) pose a significant and costly challenge to modern enterprises, often characterized by their multi-stage, stealthy, and complex nature. Traditional…
- REPLICAWATCHER: Training-less Anomaly Detection in Containerized Microservices — Asbat El Khairi
In the rapidly evolving landscape of containerized microservices, traditional anomaly detection systems face a formidable challenge: the relentless shift in what constitutes "normal" behavior. This…
- TALISMAN: Tamper Analysis for Reference Monitors — Frank Capobianco
In this presentation, Frank Capobianco introduced **TALISMAN**, an automated analysis tool designed to detect subtle yet critical flaws that can compromise the tamper-proofing of **reference…
- BliMe: Verifiably Secure Outsourced Computation with Hardware-Enforced Taint Tracking — Hossam ElAtali
The proliferation of outsourced computing, driven by its undeniable cost benefits and scalability, has introduced a fundamental challenge: maintaining the confidentiality of sensitive client data…
- Efficient Use-After-Free Prevention with Opportunistic Page-Level Sweeping — Chanyoung Park
In this insightful talk, Chanyoung Park introduced **HUSHVAC**, a novel and highly efficient approach to preventing **use-after-free (UAF)** vulnerabilities in software utilizing manual memory…
- GhostType: The Limits of Using Contactless Electromagnetic Interference to Inject Phantom Keys into Analog Circuits of Keyboards — Qinhong Jiang
In a groundbreaking presentation at NDSS 2024, Qinhong Jiang unveiled "GhostType," a novel attack demonstrating the pervasive vulnerability of modern keyboards to contactless electromagnetic…
- LiDAR Spoofing Meets the New-Gen: Capability Improvements, Broken Assumptions, and New Attack Strategies — Takami Sato
LiDAR (Light Detection And Ranging) technology stands as a cornerstone for precise, long-range 3D sensing, critically enabling the rapid advancement and deployment of autonomous driving (AD)…
- Invisible Reflections: Leveraging Infrared Laser Reflections to Target Traffic Sign Perception — Takami Sato
This talk introduces a groundbreaking and concerning vulnerability for **Connected Autonomous Vehicles (CAVs)**: the **Infrared Laser Reflection (ILR) attack**. Presented by Takami Sato, this…
- MadRadar: A Black-Box Physical Layer Attack Framework on mmWave Automotive FMCW Radars — David Hunt
In this presentation, David Hunt unveiled **MadRadar**, a groundbreaking black-box physical layer attack framework designed to target millimeter-wave (mmWave) automotive Frequency Modulated…
- Untangle: Multi-Layer Web Server Fingerprinting — Cem Topcuoglu
In the modern web landscape, sophisticated web applications are rarely deployed as monolithic, single-server entities. Instead, they commonly reside behind complex, multi-layered architectures…
- Certificate Transparency Revisited: The Public Inspections on Third-party Monitors — Aozhuo Sun
The integrity of the modern web relies heavily on **TLS certificates**, which vouch for the authenticity of websites and secure communication. However, the ecosystem built on trust in…
- Compromising Industrial Processes using Web-Based Programmable Logic Controller Malware — Ryan Pickren
This article delves into a groundbreaking security talk presented by Ryan Pickren, which introduces a novel and highly effective method for developing **Programmable Logic Controller (PLC)…
- TrustSketch: Trustworthy Sketch-based Telemetry on Cloud Hosts — Zhuo Cheng
In the dynamic landscape of cloud computing, network telemetry forms the backbone of critical management functions such as anomaly detection, precise billing, and efficient traffic engineering…
- Transpose Attack: Stealing Datasets with Bidirectional Training — Guy Amit
In an era where Artificial Intelligence (AI) underpins critical infrastructure and services, the integrity and confidentiality of training data for Deep Neural Networks (DNNs) have become paramount…
- Sneaky Spikes: Uncovering Stealthy Backdoor Attacks in Spiking Neural Networks with Neuromorphic Data — Gorka Abad
Deep Neural Networks (DNNs) have revolutionized machine learning, yet their computational demands and energy consumption pose significant challenges, particularly for resource-constrained…
- GraphGuard: Detecting and Counteracting Training Data Misuse in Graph Neural Networks — Bang Wu
Graph Neural Networks (GNNs) have emerged as a transformative technology for analyzing complex graph-structured data across diverse fields, from e-Commerce recommendations to advanced drug discovery…
- Enhance Stealthiness and Transferability of Adversarial Attacks with Class Activation Mapping Ensemble Attack — Hui Xia
This talk introduces the **Class Activation Mapping Ensemble Attack (CAM-EA)**, a novel adversarial attack method designed to significantly enhance the stealthiness and transferability of…
- A Duty to Forget, a Right to be Assured? Exposing Vulnerabilities in Machine Unlearning Services — Hongsheng Hu
This talk, presented by Hongsheng Hu at the NDSS Symposium, delves into a critical and emerging security challenge within **Machine Learning as a Service (MLaaS)** environments: the vulnerability of…
- Pencil: Private and Extensible Collaborative Learning without the Non-Colluding Assumption — Xuanqi Liu
This article delves into "Pencil," a groundbreaking framework for collaborative machine learning that addresses critical challenges in data privacy, model confidentiality, and system extensibility…
- SSL-WM: A Black-Box Watermarking Approach for Encoders Pre-trained by Self-Supervised Learning — Peizhuo Lv
Self-Supervised Learning (SSL) has revolutionized fields like Computer Vision (CV) and Natural Language Processing (NLP), enabling the creation of powerful, general-purpose encoders capable of…