Network and Distributed System Security (NDSS) Symposium 2025
The 32nd annual NDSS Symposium, a top-tier academic security conference hosted by the Internet Society, focusing on practical aspects of network and distributed system security.
→ See editor’s top picks at Network and Distributed System Security (NDSS) Symposium 2025
- Off-Path TCP Hijacking in Wi-Fi Networks: A Packet-Size Side Channel Attack — Ziqiang Wang
This talk, presented by Ziqiang Wang (representing a collaborative effort from Tsinghua University, George Mason University, and Southeast University), unveils a critical vulnerability in modern…
- CHAOS: Exploiting Station Time Synchronization in 802.11 Networks — Sirus Shahini
This talk, titled "CHAOS: Exploiting Station Time Synchronization in 802.11 Networks," presented by Sirus Shahini, unveils a novel and highly stealthy **covert channel** strategy that leverages a…
- Rediscovering Method Confusion in Proposed Security Fixes for Bluetooth — Maximilian von Tschirschnitz
In this insightful talk, Maximilian von Tschirschnitz from Atom Munich delves into the persistent and foundational security vulnerability of **method confusion** within **ad hoc pairing protocols**…
- Lend Me Your Beam: Privacy Implications of Plaintext Beamforming Feedback in WiFi — Rui Xiao
In an era where Wi-Fi devices are ubiquitous, forming the backbone of our connected lives in homes, offices, and factories, a new class of privacy-invasive attacks is emerging. This talk, "Lend Me…
- Secure IP Address Allocation at Cloud Scale — Eric Pauley
In the modern cloud computing landscape, the fundamental role of **IP addresses** has undergone a significant transformation. Historically, IP addresses served primarily as an infrastructure…
- Revealing the Black Box of Device Search Engine: Scanning Assets, Strategies, and Ethical Consideration — Mengying Wu
In an increasingly interconnected world, the proliferation of internet-connected devices has introduced unprecedented convenience alongside significant security vulnerabilities. This presentation…
- Securing BGP ASAP: ASPA and other Post-ROV Defenses — Justin Furuness
- SketchFeature: High-Quality Per-Flow Feature Extractor Towards Security-Aware Data Plane — Sian Kim
In an era where network security increasingly relies on sophisticated **AI-enhanced in-network defense** mechanisms, the ability to efficiently extract high-quality packet features has become…
- UI-CTX: Understanding UI Behaviors with Code Contexts for Mobile Applications — Jiawei Li
This talk, presented by Jiawei Li at the NDSS Symposium, introduces **UI-CTX**, a novel approach for understanding the intended behaviors of UI widgets in mobile applications by analyzing their…
- Exploring User Perceptions of Security Auditing in the Web3 Ecosystem — Molly Zhuangtong Huang
In an era defined by rapid technological advancement and increasing decentralization, the Web3 ecosystem has emerged as a transformative force, promising users greater control over their data and…
- Was This You? Investigating the Design Considerations for Suspicious Login Notifications — Sena Sahin
In an increasingly interconnected digital landscape, **account security** remains a paramount concern for users and service providers alike. A critical first line of defense against unauthorized…
- The Power of Words: A Comprehensive Analysis of Rationales and Their Effects on Users’ Permission Decisions — Yusra Elbitar
In the increasingly security-conscious landscape of mobile technology, users are frequently confronted with decisions regarding app permissions. The talk "The Power of Words: A Comprehensive…
- BULKHEAD: Secure, Scalable, and Efficient Kernel Compartmentalization with PKS — Yinggang Guo
The talk "BULKHEAD: Secure, Scalable, and Efficient Kernel Compartmentalization with PKS" by Yinggang Guo at the NDSS Symposium addresses the persistent and growing security vulnerabilities within…
- Statically Discover Cross-Entry Use-After-Free Vulnerabilities in the Linux Kernel — Hang Zhang
Use-After-Free (UAF) vulnerabilities remain one of the most dangerous and prevalent classes of software security issues, despite extensive research and development in automated detection tools. This…
- VulShield: Protecting Vulnerable Code Before Deploying Patches — Yuan Li
In the dynamic landscape of modern software, the constant emergence of vulnerabilities, particularly within foundational systems like the Linux kernel, presents a formidable challenge to security…
- Oreo: Protecting ASLR Against Microarchitectural Attacks — Shixin Song
Address Space Layout Randomization (ASLR) is a cornerstone software security mechanism, widely deployed across modern operating systems like Linux, Windows, and macOS. Its primary objective is to…
- The Philosopher’s Stone: Trojaning Plugins of Large Language Models — Tian Dong
In an era increasingly dominated by Large Language Models (LLMs), their security, particularly within the burgeoning open-source ecosystem, presents a critical challenge. This talk, "The…
- Safety Misalignment Against Large Language Models — Yichen Gong
The proliferation of Large Language Models (LLMs) has ushered in an era of unprecedented capabilities, from sophisticated conversation and writing to complex coding tasks. However, this rapid…
- I know what you MEME! Understanding and Detecting Harmful Memes with Multimodal Large Language Models — Yong Zhuang
In an era dominated by digital communication, **memes** have emerged as a pervasive and powerful form of expression, blending images and text to convey ideas, humor, and narratives across social…
- The (Un)usual Suspects – Studying Reasons for Lacking Updates in WordPress — Maria Hellenthal
In the realm of cybersecurity, the perennial challenge of keeping software up-to-date remains one of the most critical yet frequently overlooked aspects of defense. Maria Hellenthal's talk, "The…
- Duumviri: Detecting Trackers and Mixed Trackers with a Breakage Detector — He Shuang
In the realm of digital privacy, the pervasive issue of online tracking continues to challenge users and developers alike. While content blockers have become a staple for many, their reliance on…
- YuraScanner: Leveraging LLMs for Task-driven Web App Scanning — Aleksei Stafeev
This talk introduces **YuraScanner**, a groundbreaking, fully automated, and task-driven web application scanner designed to overcome the limitations of traditional blackbox testing tools. Presented…
- SCAMMAGNIFIER: Piercing the Veil of Fraudulent Shopping Website Campaigns — Marzieh Bitaab
In an insightful presentation at the NDSS Symposium, Marzieh Bitaab unveiled **SCAMMAGNIFIER**, a novel research initiative designed to expose the intricate, large-scale operations behind fraudulent…
- “Where Are We On Cyber?” – A Qualitative Study On Boards’ Cybersecurity Risk Decision Making — Jens Christian Opdenbusch
- The Kids Are All Right: Investigating the Susceptibility of Teens and Adults to YouTube Giveaway Scams — Elijah Bouma-Sims
This talk, presented by Elijah Bouma-Sims at the NDSS Symposium, delves into the pervasive issue of **YouTube giveaway scams** and critically examines the long-held assumption that minors are…
- MALintent: Coverage Guided Intent Fuzzing Framework for Android — Ammar Askar
The talk "MALintent: Coverage Guided Intent Fuzzing Framework for Android" by Ammar Askar introduces a novel approach to identifying critical vulnerabilities within Android applications by…
- You Can Rand but You Can’t Hide: A Holistic Security Analysis of Google Fuchsia’s (and gVisor’s) Network Stack — Inon Kaplan
This talk, presented by Amit Klein from the Hebrew University of Jerusalem, delves into a comprehensive security analysis of the network stacks within Google Fuchsia and Google gVisor. Fuchsia, a…
- Power-Related Side-Channel Attacks using the Android Sensor Framework — Mathias Oberhuber
In an era where mobile devices are central to our digital lives, the security of sensitive data processed on these platforms is paramount. This talk by Mathias Oberhuber from the NDSS Symposium…
- Incorporating Gradients to Rules: Towards Lightweight, Adaptive Provenance-based Intrusion Detection — Lingzhi Wang
In an era dominated by sophisticated **Advanced Persistent Threats (APTs)**, traditional intrusion detection systems (IDS) struggle to keep pace with the evolving tactics of cyber attackers. This…
- Wallbleed: A Memory Disclosure Vulnerability in the Great Firewall of China — Shencha Fan
This article delves into "Wallbleed," a significant memory disclosure vulnerability discovered in the **Great Firewall of China (GFW)**'s DNS injection system. Presented at the NDSS Symposium by…
- Heimdall: Towards Risk-Aware Network Management Outsourcing — Yuejie Wang
In an era where operational efficiency and cost reduction drive business decisions, the outsourcing of IT services, particularly **network management**, has become a pervasive trend. This talk…
- The Discriminative Power of Cross-layer RTTs in Fingerprinting Proxy Traffic — Diwen Xue
In an era of increasing internet censorship, geoblocking, and network interference, users frequently rely on encrypted tunnels and proxy servers to circumvent restrictions. This talk, "The…
- MineShark: Cryptomining Traffic Detection at Scale — Shaoke Xi
This talk introduces **MineShark**, an innovative online detection system designed to combat **cryptojacking** attacks by identifying cryptomining traffic at scale. Presented by Shaoke Xi, MineShark…
- Magmaw: Modality-Agnostic Adversarial Attacks on Machine Learning-Based Wireless Communication Systems — Jung-Woo Chang
The integration of machine learning (ML) into wireless communication systems, particularly for the nascent **AI-native 6G** networks, promises unprecedented efficiency and adaptability. However…
- Time-varying Bottleneck Links in LEO Satellite Networks: Identification, Exploits, and Countermeasures — Yangtao Deng
This talk, presented by Yangtao Deng from Chinua University on behalf of his colleagues, delves into the critical and under-explored area of security vulnerabilities within Low Earth Orbit (LEO)…
- Detecting IMSI-Catchers by Characterizing Identity Exposing Messages in Cellular Traffic — Tyler Tucker
In an era of increasing digital surveillance, the persistent threat posed by **IMSI-catchers** (International Mobile Subscriber Identity catchers) remains a critical concern. This talk, delivered by…
- Starshields for iOS: Navigating the Security Cosmos in Satellite Communication — Jiska Classen
As modern smartphones integrate advanced capabilities, Apple's introduction of satellite communication features in iOS devices marked a significant leap, promising connectivity in off-grid scenarios…
- Spatial-Domain Wireless Jamming with Reconfigurable Intelligent Surfaces — Philipp Mackensen
Wireless communication is fundamental to modern life, underpinning everything from smart home devices to critical infrastructure. However, the inherent openness of the wireless channel exposes these…
- EvoCrawl: Exploring Web Application Code and State using Evolutionary Search — Xiangyu Guo
Modern web applications present significant challenges for security scanners, particularly those operating in a blackbox manner without access to source code. This talk introduces EvoCrawl, an…
- The Skeleton Keys: A Large Scale Analysis of Credential Leakage in Mini-apps — Yizhe Shi
This talk, presented by Yizhe Shi from Fudan University, delves into the pervasive and critical issue of **credential leakage** within the rapidly expanding **super-app and mini-app ecosystem**. The…
- Understanding Miniapp Malware: Identification, Dissection, and Characterization — Yuqing Yang
The proliferation of **mini apps** within "super app" ecosystems has revolutionized mobile user experience, offering diverse functionalities within a single, lightweight platform. However, this…
- What’s Done Is Not What’s Claimed: Detecting and Interpreting Inconsistencies in App Behaviors — Chang Yue
Mobile applications have become indispensable, yet their extensive access to private user data—such as contacts, photos, and locations—poses significant privacy risks. Despite operating systems…
- Hitchhiking Vaccine: Enhancing Botnet Remediation With Remote Code Deployment Reuse — Runze Zhang
The persistent struggle against botnets has long been a challenging endeavor for security researchers and law enforcement agencies. Traditional botnet takedown methods, while effective at disrupting…
- A Key-Driven Framework for Identity-Preserving Face Anonymization — Miaomiao Wang
- THEMIS: Regulating Textual Inversion for Personalized Concept Censorship — Yutong Wu
This talk introduces THEMIS, a novel framework designed to inject concept censorship capabilities into **Textual Inversion** embeddings, a popular technique for personalizing image generation…
- Explanation as a Watermark: Towards Harmless and Multi-bit Model Ownership Verification via Watermarking Feature Attribution — Shuo Shao
In an era increasingly shaped by artificial intelligence, the intellectual property embedded within high-performing **deep neural networks (DNNs)** has become an invaluable asset. Training these…
- GAP-Diff: Protecting JPEG-Compressed Images from Diffusion-based Facial Customization — Haotian Zhu
The proliferation of **text-to-image diffusion models** has ushered in an era of unprecedented creative potential, allowing users to generate highly customized and realistic images from simple text…
- Towards Understanding Unsafe Video Generation — Yan Pang
The rapid advancement of generative AI models has unlocked unprecedented creative capabilities, but also introduced significant security and ethical challenges, particularly concerning the…
- Deanonymizing Device Identities via Side-channel Attacks in Exclusive-use IoTs & Mitigation — Christopher Ellis
This talk, presented by Christopher Ellis, a PhD student at Ohio State University, unveils a critical and historically overlooked flaw in the communication patterns of **exclusive-use IoT devices**…
- EAGLEYE: Exposing Hidden Web Interfaces in IoT Devices via Routing Analysis — Hangtian Liu
The proliferation of Internet of Things (IoT) devices has brought unprecedented convenience, but it has also opened a Pandora's box of security vulnerabilities. Among the myriad threats, **hidden…
- Hidden and Lost Control: on Security Design Risks in IoT User-Facing Matter Controller — Haoqiang Wang, Yiwei Fang
The proliferation of Internet of Things (IoT) devices has led to a fragmented and complex ecosystem, with numerous vendors, proprietary protocols, and disparate companion applications. To address…
- Evaluating Machine Learning-Based IoT Device Identification Models for Security Applications — Eman Maali
In an increasingly interconnected world, the proliferation of Internet of Things (IoT) devices presents both convenience and significant security challenges. As these devices become ubiquitous in…
- VoiceRadar: Voice Deepfake Detection using Micro-Frequency and Compositional Analysis — Kavita Kumari
The proliferation of sophisticated **deepfake audio** poses a significant and escalating threat to personal and societal security. From bypassing **voice authentication** systems to propagating…
- Characterizing the Impact of Audio Deepfakes in the Presence of Cochlear Implant — Magdalena Pasternak
In an era increasingly shaped by artificial intelligence, the proliferation of deepfakes poses a significant and evolving threat across various domains, from political disinformation to…
- SongBsAb: A Dual Prevention Approach against Singing Voice Conversion based Illegal Song Covers — Guangke Chen
In an era increasingly dominated by AI-generated content, the music industry faces unprecedented challenges, particularly from **AI-based automated song covers**. These sophisticated tools leverage…
- Speak Up, I’m Listening: Extracting Speech from Zero-Permission VR Sensors — Derin Cayir
- Secure Transformer Inference Made Non-interactive — Jiawen Zhang
The rapid advancement of transformer models has revolutionized artificial intelligence, powering applications from language translation to content generation and question answering. However, the…
- Revisiting EM-based Estimation for Locally Differentially Private Protocols — Yutong Ye
This talk, presented by Yutong Ye on behalf of co-authors, delves into critical improvements for **Expectation Maximization (EM)**-based estimation within **Locally Differentially Private (LDP)**…
- BumbleBee: Secure Two-party Inference Framework for Large Transformers — Wen-jie Lu
This article delves into "BumbleBee," a novel secure two-party inference framework designed for large transformer models, presented by Wen-jie Lu from Zjanu at the NDSS Symposium. The talk addresses…
- Repurposing Neural Networks for Efficient Cryptographic Computation — Xin Jin
In an era increasingly reliant on robust digital security, the performance of cryptographic operations remains a critical bottleneck. This talk, "Repurposing Neural Networks for Efficient…
- Kronos: A Secure and Generic Sharding Blockchain Consensus with Optimized Overhead — Yizhong Liu
This talk introduces **Kronos**, a novel sharding blockchain consensus protocol designed to address the critical scalability and security challenges inherent in existing sharded blockchain…
- Manifoldchain: Maximizing Blockchain Throughput via Bandwidth-Clustered Sharding — Chunjiang Che
In a presentation at the NDSS Symposium, researcher Chunjiang Che introduced **Manifoldchain**, a novel sharding protocol designed to significantly enhance blockchain throughput. The talk, titled…
- The Forking Way: When TEEs Meet Consensus — Annika Wilde
In "The Forking Way: When TEEs Meet Consensus," Annika Wilde from Ruhr University Bochum presents a critical examination of the interplay between Trusted Execution Environments (TEEs) and blockchain…
- Eclipse Attacks on Monero’s Peer-to-Peer Network — Ruisheng Shi
This article delves into a critical security vulnerability affecting Monero, a prominent privacy-focused cryptocurrency. The talk, titled "Eclipse Attacks on Monero’s Peer-to-Peer Network,"…
- Moneta: Ex-Vivo GPU Driver Fuzzing by Recalling In-Vivo Execution States — Joonkyo Jung
The talk "Moneta: Ex-Vivo GPU Driver Fuzzing by Recalling In-Vivo Execution States," presented by Joonkyo Jung of Jon University, introduces a novel fuzzing framework designed to uncover…
- ICSQuartz: Scan Cycle-Aware and Vendor-Agnostic Fuzzing for Industrial Control Systems — Corban Villa
In this compelling talk at the NDSS Symposium, Corban Villa from the moment lab at NYU Abu Dhabi presented "ICSQuartz," a novel fuzzing framework designed to enhance the security of Industrial…
- FUZZUER: Enabling Fuzzing of UEFI Interfaces on EDK-2 — Connor Glosner
The "FUZZUER: Enabling Fuzzing of UEFI Interfaces on EDK-2" talk, presented by Connor Glosner from Purdue University, introduces a novel framework for automatically generating fuzzing harnesses and…
- Truman: Constructing Device Behavior Models from OS Drivers to Fuzz Virtual Devices — Zheyu Ma
In the rapidly expanding landscape of cloud computing, hypervisors serve as the foundational layer, orchestrating virtual machines and ensuring the efficient, isolated, and secure sharing of…
- Delay-allowed Differentially Private Data Stream Release — Xiaochen Li
In an era where continuous data streams power everything from smart city infrastructure to personalized health applications, the challenge of preserving individual privacy while extracting valuable…
- Automated Expansion of Privacy Data Taxonomy for Compliant Data Breach Notification — Yue Qin
This article delves into the research presented by Yue Qin at the NDSS Symposium, focusing on an innovative approach to overcome a persistent challenge in privacy compliance: the significant gap…
- Onion Franking: Abuse Reports for Mix-Based Private Messaging — Matthew Gregoire
In the realm of secure communication, end-to-end encrypted (E2EE) messaging systems have become the gold standard for protecting message content. However, as Matthew Gregoire highlights in his NDSS…
- Ring of Gyges: Accountable Anonymous Broadcast via Secret-Shared Shuffle — Wentao Dong
In an increasingly interconnected world, the ability to broadcast messages anonymously has become a critical feature, empowering free expression, supporting whistleblowers, and enabling…
- Passive Inference Attacks on Split Learning via Adversarial Regularization — Xiaochen Zhu
Split Learning (SL) has emerged as a promising paradigm for collaborative machine learning, designed to address the challenges of distributed data, limited computational resources on client devices…
- SafeSplit: A Novel Defense Against Client-Side Backdoor Attacks in Split Learning — Phillip Rieger
This talk introduces **SafeSplit**, a novel defense mechanism designed to protect **split learning** (SL) systems from client-side backdoor attacks. Given by Phillip Rieger from Todd Damshot (likely…
- RAIFLE: Reconstruction Attacks on Interaction-based Federated Learning with Adversarial Data Manipulation — Dzung Pham
Dzung Pham from the University of Massachusetts Amherst presented "RAIFLE: Reconstruction Attacks on Interaction-based Federated Learning with Adversarial Data Manipulation" at the NDSS Symposium…
- URVFL: Undetectable Data Reconstruction Attack on Vertical Federated Learning — Duanyi Yao
This talk introduces **URVFL (Undetectable Data Reconstruction Attack on Vertical Federated Learning)**, a novel and potent data reconstruction attack designed to operate stealthily against Vertical…
- Non-intrusive and Unconstrained Keystroke Inference in VR Platforms via Infrared Side Channel — Tao Ni
As virtual reality (VR) technologies become increasingly integrated into daily life, spanning immersive gaming, healthcare, online meetings, and industrial design, the security implications of these…
- KernelSnitch: Side Channel-Attacks on Kernel Data Structures — Lukas Maar
"KernelSnitch" presents a groundbreaking investigation into a novel operating system side channel that leverages subtle timing differences when accessing kernel data structures. Presented by Lukas…
- A Systematic Evaluation of Novel and Existing Cache Side Channels — Fabian Rauscher
This talk, presented by Fabian Rauscher at the NDSS Symposium, introduces three novel cache side-channel attack primitives utilizing the recently introduced Intel `CLDEMOTE` instruction. Beyond the…
- Secret Spilling Drive: Leaking User Behavior through SSD Contention — Jonas Juffinger
In an era where Solid State Drives (SSDs) are rapidly becoming the dominant storage technology across computing platforms, the talk "Secret Spilling Drive: Leaking User Behavior through SSD…
- Transparency or Information Overload? Evaluating Users’ Comprehension and Perceptions of the iOS App Privacy Report — Xiaoyuan Wu
In an era of increasing data collection and privacy concerns, transparency has emerged as a critical tool for empowering users. Apple's introduction of the **App Privacy Report (APR)** in iOS 15…
- I Know What You Asked: Prompt Leakage via KV-Cache Sharing in Multi-Tenant LLM Serving — Guanlong Wu
This talk, presented by Guanlong Wu from Southern University of Science and Technology (SUST), uncovers a critical vulnerability in multi-tenant Large Language Model (LLM) serving systems: **prompt…
- IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems — Yuhao Wu
The advent of Large Language Models (LLMs) has ushered in a powerful new computing paradigm, giving rise to sophisticated **agentic systems** capable of orchestrating diverse resources to fulfill…
- LeakLess: Selective Data Protection against Memory Leakage Attacks for Serverless Platforms — Maryam Rostamipoor
- Blindfold: Confidential Memory Management by Untrusted Operating System — Caihua Li
In an era where operating systems (OS) are increasingly complex and prone to vulnerabilities, the security of sensitive application data stored in memory remains a critical concern. The talk…
- TME-Box: Scalable In-Process Isolation through Intel TME-MK Memory Encryption — Martin Unterguggenberger
In the realm of modern cloud computing, the relentless pursuit of performance and efficiency has driven a shift from heavyweight process isolation to more lightweight, in-process sandboxes. While…
- PhantomLiDAR: Cross-modality Signal Injection Attacks against LiDAR — Zizhi Jin
LiDAR (Light Detection and Ranging) systems are foundational technologies for autonomous vehicles, robotics, and various industrial applications, providing critical 3D perception of the environment…
- PowerRadio: Manipulate Sensor Measurement via Power GND Radiation — Yan Jiang
In an era increasingly reliant on sensor-driven systems for everything from smart homes to critical infrastructure, the integrity of sensor readings is paramount. This talk, "PowerRadio: Manipulate…
- Interventional Root Cause Analysis of Failures in Multi-Sensor Fusion Perception Systems — Shuguang Wang
Autonomous driving systems, particularly their perception modules, are critical for safe and reliable operation. These systems rely on **multi-sensor fusion** to process data from various sensors…
- Too Subtle to Notice: Investigating Executable Stack Issues in Linux Systems — Hengkai Ye
In this presentation, Hengkai Ye from Pensday delves into a surprising and persistent security vulnerability: the existence of executable stacks in modern Linux systems, despite decades of…
- RACONTEUR: A Knowledgeable, Insightful, and Portable LLM-Powered Shell Command Explainer — Jiangyi Deng
In the evolving landscape of cyber threats, understanding the true intent and capabilities of malicious shell commands is a critical yet often challenging task for security analysts. The "RACONTEUR…
- GadgetMeter: Quantitatively and Accurately Gauging the Exploitability of Speculative Gadgets — Qi Ling
Since their public disclosure in 2018, **speculative execution attacks**, most notably Spectre, have presented a persistent and severe threat to modern computer systems. These attacks exploit a…
- ReDAN: An Empirical Study on Remote DoS Attacks against NAT Networks — Xuewei Feng
This article delves into "ReDAN: An Empirical Study on Remote DoS Attacks against NAT Networks," a pivotal talk delivered by Xuewei Feng at the NDSS Symposium. The presentation uncovers a series of…
- A Large-Scale Measurement Study of the PROXY Protocol and its Security Implications — Stijn Pletinckx
In a critical presentation at the NDSS Symposium, Stijn Pletinckx from UC Santa Barbara unveiled a comprehensive large-scale measurement study on the **PROXY protocol**, revealing widespread…
- ProvGuard: Detecting SDN Control Policy Manipulation via Contextual Semantics of Provenance Graphs — Ziwen Liu
This article delves into "ProvGuard," a novel system designed to detect subtle control policy manipulations (CPM) within Software-Defined Networks (SDN). Presented by Ziwen Liu at the NDSS…
- LAMP: Lightweight Approaches for Latency Minimization in Mixnets with Practical Deployment Considerations — Mahdi Rahimi
This talk, presented at the NDSS Symposium, introduces LAMP, a novel framework designed to significantly reduce end-to-end latency in **continuous mix networks** without compromising their crucial…
- Mysticeti: Reaching the Latency Limits with Uncertified DAGs — Kushal Babel
This article delves into Mysticeti, a novel **Byzantine fault-tolerant (BFT)** consensus protocol developed by Mist Labs, presented by Kushal Babel at the NDSS Symposium. Mysticeti belongs to the…
- SCRUTINIZER: Towards Secure Forensics on Compromised TrustZone — Yiming Zhang
The talk "SCRUTINIZER: Towards Secure Forensics on Compromised TrustZone," presented by Fung Jan, delves into the critical challenge of performing secure and reliable forensics on **Trusted…
- A Formal Approach to Multi-Layered Privileges for Enclaves — Ganxiang Yang
Ganxiang Yang from Shanghai Jotto University presented groundbreaking research on "A Formal Approach to Multi-Layered Privileges for Enclaves" at the NDSS Symposium. This talk addresses a critical…
- CounterSEVeillance: Performance-Counter Attacks on AMD SEV-SNP — Stefan Gast
In the rapidly evolving landscape of confidential computing, **Confidential Virtual Machines (CVMs)** represent a significant stride towards protecting data in use. This talk, "CounterSEVeillance…
- TZ-DATASHIELD: Automated Data Protection for Embedded Systems via Data-Flow-Based Compartmentalization — Zelun Kong
Microcontroller Units (MCUs) form the backbone of countless critical embedded systems, from healthcare devices and industrial automation to autonomous vehicles. Despite their pervasive use in…
- The Road to Trust: Building Enclaves within Confidential VMs — Wenhao Wang
This talk, "The Road to Trust: Building Enclaves within Confidential VMs," presented by Wenhao Wang, introduces **Nested SGX**, a novel architecture designed to enhance the security of confidential…
- Rondo: Scalable and Reconfiguration-Friendly Randomness Beacon — Xuanji Meng
In an increasingly decentralized digital landscape, the need for robust, unpredictable, and publicly verifiable randomness is paramount. This talk at NDSS25 introduces Rondo, a novel **Distributed…
- Distributed Function Secret Sharing and Applications — Pengzhi Xing
This talk, presented by Pengzhi Xing at the NDSS Symposium, delves into the critical advancements in **Distributed Function Secret Sharing (DFSS)** and its practical applications within the realm of…
- PQConnect: Automated Post-Quantum End-to-End Tunnels — Daniel J. Bernstein
This talk introduces **PQConnect**, an innovative system designed to establish automated, end-to-end post-quantum secure tunnels for all network traffic originating from a host. Developed as joint…
- Impact Tracing: Identifying the Culprit of Misinformation in Encrypted Messaging Systems — Zhongming Wang
The widespread adoption of **end-to-end encryption (E2EE)** in popular messaging platforms like WhatsApp, Signal, and iMessage has dramatically enhanced user privacy by concealing message content…
- DiStefano: Decentralized Infrastructure for Sharing Trusted Encrypted Facts and Nothing More — Sofia Celi
In an era increasingly concerned with data privacy and the pervasive collection of personal information, the DiStefano protocol emerges as a pivotal advancement in enabling privacy-preserving…
- AlphaDog: No-Box Camouflage Attacks via Alpha Channel Oversight — Qi Xia
This article delves into "AlphaDog," a groundbreaking adversarial attack presented by Qi Xia at the NDSS Symposium. AlphaDog introduces the concept of a **no-box camouflage attack**, a novel method…
- Understanding Data Importance in Machine Learning Attacks: Does Valuable Data Pose Greater Harm? — Rui Wen
In an era increasingly defined by Artificial Intelligence, the foundational role of data in driving Machine Learning (ML) innovation cannot be overstated. From large language models like ChatGPT to…
- DLBox: New Model Training Framework for Protecting Training Data — Jaewon Hur
The proliferation of artificial intelligence, particularly deep learning, has led to an increasing demand for vast datasets to train sophisticated models. However, a significant hurdle in this…
- A New PPML Paradigm for Quantized Models — Tianpei Lu
This talk introduces a groundbreaking new paradigm for **Privacy-Preserving Machine Learning (PPML)** specifically tailored for **quantized models**. Presented by Bingshan from Jan University, the…
- Probe-Me-Not: Protecting Pre-trained Encoders from Malicious Probing — Ruyi Ding
In the rapidly evolving landscape of machine learning, the paradigm of **transfer learning** has become a cornerstone, enabling the development of highly accurate models with significantly reduced…
- Cascading Spy Sheets: Exploiting the Complexity of Modern CSS for Email and Browser Fingerprinting — Leon Trampert
In "Cascading Spy Sheets," Leon Trampert from Sisba unveils a novel and potent method for user fingerprinting that leverages the intricate capabilities of modern CSS, effectively circumventing…
- HADES Attack: Understanding and Evaluating Manipulation Risks of Email Blocklists — Ruixuan Li
In the realm of cybersecurity, email remains a critical communication channel, and its integrity is constantly under threat from spam and malicious actors. To combat this, **DNS-based Blocklists…
- Automatic Insecurity: Exploring Email Auto-configuration in the Wild — Shushang Wen
Email remains a cornerstone of digital communication, underpinning both personal and professional interactions. Setting up an email account, however, often involves a complex array of technical…
- A Multifaceted Study on the Use of TLS and Auto-detect in Email Ecosystems — Ka Fun Tang
This talk, presented by Ka Fun Tang, delves into critical security vulnerabilities within the modern email ecosystem, specifically focusing on the client-to-server connections governed by IMAP and…
- ReThink: Reveal the Threat of Electromagnetic Interference on Power Inverters — Fengchen Yang
This talk, titled "ReThink: Reveal the Threat of Electromagnetic Interference on Power Inverters," presented by Fengchen Yang from Jodang University, delves into a critical and often overlooked…
- LightAntenna: Characterizing the Limits of Fluorescent Lamp-Induced Electromagnetic Interference — Fengchen Yang
This talk introduces **LightAntenna**, a novel and concerning electromagnetic interference (EMI) attack vector that leverages ubiquitous fluorescent lamps to inject malicious signals into nearby…
- GhostShot: Manipulating the Image of CCD Cameras with Electromagnetic Interference — Yanze Ren
In a groundbreaking presentation at the NDSS Symposium, Yanze Ren unveiled "GhostShot," a novel attack demonstrating the ability to manipulate images captured by **Charge-Coupled Device (CCD)…
- EMIRIS: Eavesdropping on Iris Information via Electromagnetic Side Channel — Wenhao Li
The talk "EMIRIS: Eavesdropping on Iris Information via Electromagnetic Side Channel" presented by Wenhao Li from Shano University, unveils a novel and concerning vulnerability in iris recognition…
- Mens Sana In Corpore Sano: Sound Firmware Corpora for Vulnerability Research — René Helmke
René Helmke from Franova presented a critical analysis of the current state of firmware corpus creation in vulnerability research, advocating for a more "scientifically sound" approach. The talk…
- LLMPirate: LLMs for Black-box Hardware IP Piracy — Vasudev Gohil
In the rapidly evolving landscape of Large Language Models (LLMs), their applications span numerous domains, from finance and education to software development and even semiconductor chip design…
- CCTAG: Configurable and Combinable Tagged Architecture — Zhanpeng Liu
Memory safety vulnerabilities remain a critical and pervasive threat in modern software systems, often leading to severe security breaches. Despite ongoing efforts to identify and patch these flaws…
- A Comprehensive Memory Safety Analysis of Bootloaders — Jianqiang Wang
This presentation, delivered by Jianqiang Wang on behalf of the authors, delves into a comprehensive memory safety analysis of bootloaders, a critical component in the secure boot chain of modern…
- Balancing Privacy and Data Utilization: A Comparative Vignette Study on User Acceptance of Data Trustees in Germany and the US — Leona Lassak
This talk, presented by Leona Lassak, delves into the nascent concept of **data trustees** as a potential solution to the pervasive problem of opaque and untransparent data sharing in modern…
- PolicyPulse: Precision Semantic Role Extraction for Enhanced Privacy Policy Comprehension — Andrick Adhikari
In an era of increasing data privacy concerns, **privacy policies** serve as critical documents designed to inform users about an organization's data collection, processing, and sharing practices…
- SKILLPoV: Towards Accessible and Effective Privacy Notice for Amazon Alexa Skills — Jingwen Yan
The proliferation of voice applications, particularly Amazon Alexa skills, has brought unprecedented convenience to users. However, this convenience often comes with significant privacy concerns, as…
- ”Who is Trying to Access My Account?” Exploring User Perceptions and Reactions to Risk-based Authentication Notifications — Tongxin Wei
In an era where account security is paramount, but user fatigue with complex authentication methods is common, **Risk-Based Authentication Notifications (RBANs)** offer a crucial middle ground. This…
- An Empirical Study on Fingerprint API Misuse with Lifecycle Analysis in Real-world Android Apps — Xin Zhang
This talk, presented by Xin Zhang from Fudan University, delves into the pervasive security vulnerabilities stemming from the misuse of **Fingerprint-Based Authentication (FBO)** APIs in real-world…
- Vulnerability, Where Art Thou? An Investigation of Vulnerability Management in Android Smartphone Chipsets — Daniel Klischies
While much attention in Android security research typically focuses on application vulnerabilities or issues within the Android operating system itself, a critical and often overlooked area is the…
- ScopeVerif: Analyzing the Security of Android’s Scoped Storage via Differential Analysis — Zeyu Lei
This talk introduces **ScopeVerif**, a novel dynamic analysis framework designed to rigorously evaluate the security, correctness, and consistency of Android's **Scoped Storage** model. Presented by…
- Compiled Models, Built-In Exploits: Uncovering Pervasive Bit-Flip Attack Surfaces in DNN Executables — Yanzuo Chen
In a groundbreaking presentation at the NDSS Symposium, Yanzuo Chen unveiled critical vulnerabilities within Deep Neural Network (DNN) executables, demonstrating a novel and highly effective…
- BitShield: Defending Against Bit-Flip Attacks on DNN Executables — Yanzuo Chen
As artificial intelligence (AI) systems become increasingly integrated into critical aspects of daily life, ranging from autonomous vehicles to financial services, the imperative for their robust…
- ASGARD: Protecting On-Device Deep Neural Networks with Virtualization-Based Trusted Execution Environments — Myungsuk Moon
The proliferation of on-device Artificial Intelligence (AI) services offers significant advantages over traditional cloud-based AI, primarily by keeping sensitive user data local and avoiding…
- Ctrl+Alt+Deceive: Quantifying User Exposure to Online Scams — Platon Kotzias
In "Ctrl+Alt+Deceive: Quantifying User Exposure to Online Scams," Platon Kotzias, representing a collaborative effort between the Norton Research Group and the India Software Institute, presents a…
- The Guardians of Name Street: Studying the Defensive Registration Practices of the Fortune 500 — Boladji Vinny Adjibi
In the digital age, domain names serve as crucial interfaces between companies and their customers, facilitating access to services and establishing brand identity. However, this essential asset is…
- Dissecting Payload-based Transaction Phishing on Ethereum — Zhuo Chen
In a revealing presentation at the NDSS Symposium, Zhuo Chen of Zhejiang University unveiled critical research dissecting **payload-based transaction phishing** on the Ethereum blockchain. This talk…
- Tweezers: A Framework for Security Event Detection via Event Attribution-centric Tweet Embedding — Jian Cui
This talk introduces **Tweezers**, a novel framework designed to enhance the detection of security events from social media platforms, specifically Twitter. Presented by Jian Cui, a PhD student at…
- Rethinking Trust in Forge-Based Git Security — Aditya Sirish A Yelgundhalli
In the realm of software supply chain security, the integrity of source code stands as a foundational pillar. This talk, delivered by Aditya Sirish A Yelgundhalli, a PhD student at New York…
- Attributing Open-Source Contributions is Critical but Difficult: A Systematic Analysis of GitHub Practices and Their Impact on Software Supply Chain Security — Jan-Ulrich Holtgrave
In an era of increasing data privacy regulations, the "right to be forgotten" has become a critical challenge for machine learning systems. This technical article synthesizes key insights from a…
- WAVEN: WebAssembly Memory Virtualization for Enclaves — Weili Wang
The talk "WAVEN: WebAssembly Memory Virtualization for Enclaves" by Weili Wang introduces a novel memory virtualization scheme designed to enhance the capabilities of WebAssembly (Wasm) within…
- Secure Data Analytics in Apache Spark with Fine-grained Policy Enforcement and Isolated Execution — Byeongwook Kim
In an era defined by massive data generation and the increasing demand for collaborative analytics, cloud-based Apache Spark has emerged as a cornerstone for processing big data. However, the…
- RContainer: A Secure Container Architecture through Extending ARM CCA Hardware Primitives — Qihang Zhou
The proliferation of containers in modern cloud computing environments has brought significant benefits in terms of efficient deployment and high resource utilization. However, their inherent weak…
- ERW-Radar: An Adaptive Detection System against Evasive Ransomware by Contextual Behavior Detection and Fine-grained Content Analysis — Lingbo Zhao
This article delves into ERW-Radar, an innovative adaptive detection system designed to combat the growing threat of **evasive ransomware**. Presented by Lingbo Zhao at the NDSS Symposium, the talk…
- All your (data)base are belong to us: Characterizing Database Ransom(ware) Attacks — Kevin van Liebergen
In an increasingly digital world, databases serve as the bedrock for countless services, storing critical information that ranges from personal data to operational intelligence. This centrality…
- Detecting Ransomware Despite I/O Overhead: A Practical Multi-Staged Approach — Christian van Sloun
Ransomware continues to pose a significant threat to cybersecurity, consistently ranking among the top concerns for organizations worldwide. Attacks like the 2021 Colonial Pipeline incident…
- On the Robustness of LDP Protocols for Numerical Attributes under Data Poisoning Attacks — Xiaoguang Li
This talk, presented by Buhan from Purdue University, delves into a critical and emerging threat to **Local Differential Privacy (LDP)** protocols: **data poisoning attacks**. While LDP is a…
- Iris: Dynamic Privacy Preserving Search in Authenticated Chord Peer-to-Peer Networks — Angeliki Aktypi
In the realm of decentralized systems, **Chord peer-to-peer (P2P) networks** have long been lauded for their efficiency and simplicity in managing distributed key-value stores. They form the…
- Recurrent Private Set Intersection for Unbalanced Databases with Cuckoo Hashing and Leveled FHE — Eduardo Chielle
This talk by Eduardo Chielle introduces a novel protocol for **Private Set Intersection (PSI)**, specifically designed to address the challenges of **recurrent** intersections involving **unbalanced…
- TrajDeleter: Enabling Trajectory Forgetting in Offline Reinforcement Learning Agents — Chen Gong
This talk introduces **TrajDeleter**, a novel framework designed to enable efficient and stable trajectory forgetting in **offline reinforcement learning (RL)** agents. Presented by Chen Gong from…
- Reinforcement Unlearning — Dayong Ye
In an era increasingly shaped by artificial intelligence, the ability for machine learning models to "forget" specific information has become paramount, driven by privacy regulations, the need for…
- Provably Unlearnable Data Examples — Derui Wang
In an era dominated by large language models and advanced machine learning, the ease with which public data can be exploited poses significant risks, ranging from intellectual property infringement…
- Silence False Alarms: Identifying Anti-Reentrancy Patterns on Ethereum to Refine Smart Contract Reentrancy Detection — Qiyang Song
The proliferation of smart contracts on platforms like Ethereum has introduced novel security challenges, with reentrancy remaining one of the most infamous and financially devastating…
- PropertyGPT: LLM-driven Formal Verification of Smart Contracts through Retrieval-Augmented Property Generation — Ye Liu
The rapid proliferation of smart contracts on blockchain systems has ushered in a new era of decentralized applications, managing billions in digital assets. However, this innovation comes with…
- Alba: The Dawn of Scalable Bridges for Blockchains — Giulia Scaffino
In this insightful talk from the NDSS Symposium, Giulia Scaffino introduced **Alba**, a groundbreaking protocol designed to overcome two of the most significant limitations plaguing modern…
- Horcrux: Synthesize, Split, Shift and Stay Alive; Preventing Channel Depletion via Universal and Enhanced Multi-hop Payments — Anqi Tian
This article delves into "Horcrux," a groundbreaking protocol presented at the NDSS Symposium, designed to fundamentally address the persistent problem of fund depletion in **payment channel…
- VeriBin: Adaptive Verification of Patches at the Binary Level — Hongwei Wu
In the critical realm of software security, maintaining vulnerabilities without introducing new issues is a perpetual challenge. The adage "if it ain't broke, don't fix it" often dictates vendor…
- Beyond Classification: Inferring Function Names in Stripped Binaries via Domain Adapted LLMs — Linxi Jiang
The ability to accurately infer function names in **stripped binaries** is a critical challenge in reverse engineering, with profound implications for fields such as **malware analysis**…
- BinEnhance: An Enhancement Framework Based on External Environment Semantics for Binary Code Search — Yongpan Wang
This talk introduces **BinEnhance**, a novel enhancement framework designed to significantly improve the accuracy and robustness of binary code search. Presented by Limbo J on behalf of author…
- Unleashing the Power of Generative Model in Recovering Variable Names from Stripped Binary — Xiangzhe Xu
In this compelling talk at the NDSS Symposium, Xiangzhe Xu from Purdue University presented groundbreaking research on recovering variable names from stripped binaries using generative code models…
- Cross-Origin Web Attacks via HTTP/2 Server Push and Signed HTTP Exchange — Pinji Chen
The talk "Cross-Origin Web Attacks via HTTP/2 Server Push and Signed HTTP Exchange," presented by Pinji Chen from Chinuan University, unveils a critical reinterpretation of web security's…
- Misdirection of Trust: Demystifying the Abuse of Dedicated URL Shortening Service — Zhibo Zhang
In an increasingly interconnected digital landscape, URL shortening services have become indispensable tools for simplifying link sharing and enabling user tracking. While popular shared services…
- Do (Not) Follow the White Rabbit: Challenging the Myth of Harmless Open Redirection — Soheil Khodayari
This talk, presented by Gianluca Golinelli on behalf of authors Sel Kai and Gian Carlo, challenges the long-held industry belief that **open redirect vulnerabilities** are relatively harmless…
- Blackbox Fuzzing of Distributed Systems with Multi-Dimensional Inputs and Symmetry-Based Feedback Pruning — Yonghao Zou
Modern digital infrastructure relies heavily on distributed systems, from databases like ClickHouse and RethinkDB to crucial coordination systems. However, the inherent complexity of these systems…
- QMSan: Efficiently Detecting Uninitialized Memory Errors During Fuzzing — Matteo Marini
In the realm of software security, **Use of Uninitialized Memory (UUM)** errors represent a particularly insidious class of vulnerabilities. These errors occur when a program attempts to read from a…
- Automatic Library Fuzzing through API Relation Evolvement — Jiayi Lin
Software libraries form the foundational components of countless applications, yet they often harbor complex vulnerabilities that are difficult to uncover through traditional testing methods. This…
- TWINFUZZ: Differential Testing of Video Hardware Acceleration Stacks — Matteo Leonelli
In the realm of modern computing, hardware acceleration stacks are ubiquitous, powering everything from high-performance graphics to efficient video playback. However, the intricate, multi-layered…
- CENSOR: Defense Against Gradient Inversion via Orthogonal Subspace Bayesian Sampling — Kaiyuan Zhang
In an era where data privacy is paramount, **federated learning (FL)** has emerged as a promising distributed machine learning paradigm. It allows multiple clients to collaboratively train a shared…
- Do We Really Need to Design New Byzantine-robust Aggregation Rules? — Minghong Fang
This talk, presented by Minghong Fang at the NDSS Symposium, challenges the prevailing trend in Federated Learning (FL) security research: the continuous development of increasingly complex…
- Scale-MIA: A Scalable Model Inversion Attack against Secure Federated Learning via Latent Space Reconstruction — Shanghao Shi
This article delves into "Scale-MIA," a sophisticated model inversion attack that challenges the privacy guarantees of federated learning (FL) systems. Presented by Shanghao Shi, a PhD candidate at…
- Privacy-Preserving Data Deduplication for Enhancing Federated Learning of Language Models — Aydin Abadi
This talk, presented by Vishnu Dasu, a PhD student at the Pennsylvania State University, introduces a novel solution called **Efficient Privacy-Preserving Multi-Party Deduplication (EPMPD)**. The…
- MingledPie: A Cluster Mingling Approach for Mitigating Preference Profiling in CFL — Cheng Zhang
Federated Learning (FL) offers a privacy-preserving framework for collaborative machine learning, allowing multiple clients to train a shared model without centralizing their sensitive data…
- Careful About What App Promotion Ads Recommend! Detecting and Explaining Malware Promotion via App Promotion Graph — Shang Ma
This talk, presented by Shang Ma from the University of Nardam, delves into a critical and often overlooked vector for mobile malware distribution: app promotion ads. While ad-supported apps are…
- Revisiting Concept Drift in Windows Malware Detection: Adaptation to Real Drifted Malware with Minimal Samples — Adrian Shuai Li
The relentless evolution of Windows malware poses a significant challenge for machine learning-based detection systems. Traditional models, trained on known samples, quickly become obsolete when…
- PBP: Post-training Backdoor Purification for Malware Classifiers — Dung Thuy Nguyen
In an era where machine learning (ML) and deep learning (DL) models are increasingly becoming foundational components for critical security tasks, such as malware detection, ensuring their integrity…
- Density Boosts Everything: A One-stop Strategy for Improving Performance, Robustness, and Sustainability of Malware Detectors — Jianwen Tian
This article delves into a compelling presentation from the NDSS Symposium, titled "Density Boosts Everything: A One-stop Strategy for Improving Performance, Robustness, and Sustainability of…
- Automated Mass Malware Factory: The Convergence of Piggybacking and Adversarial Example in Android Malicious Software Generation — Heng Li
- Black-box Membership Inference Attacks against Fine-tuned Diffusion Models — Yan Pang
This talk, presented by Yan Pang at the NDSS Symposium, delves into the critical area of data privacy concerning the rapidly evolving landscape of generative AI, specifically **diffusion models**…
- Diffence: Fencing Membership Privacy With Diffusion Models — Yuefeng Peng
In an era where machine learning models are increasingly deployed across sensitive domains, the privacy of training data has become a paramount concern. This talk, "Diffence: Fencing Membership…
- A Method to Facilitate Membership Inference Attacks in Deep Learning Models — Zitao Chen
In an era increasingly reliant on machine learning, the privacy of training data has become a paramount concern. This talk by Zitao Chen at the NDSS Symposium introduces a groundbreaking and…
- SIGuard: Guarding Secure Inference with Post Data Privacy — Xinqian Wang
The proliferation of machine learning as a service (MLaaS) has revolutionized how intelligence is consumed, offering sophisticated prediction capabilities through cloud-hosted neural networks. While…
- Defending Against Membership Inference Attacks on Iteratively Pruned Deep Neural Networks — Jing Shang
In an era defined by the escalating scale of deep neural networks (DNNs) and the concurrent demand for their deployment on resource-constrained devices, model compression techniques have become…
- LADDER: Multi-Objective Backdoor Attack via Evolutionary Algorithm — Dazhuang Liu
This talk introduces LADDER, a novel approach to crafting **backdoor attacks** in computer vision tasks that simultaneously optimizes multiple, often conflicting, attack objectives. Presented by…
- CLIBE: Detecting Dynamic Backdoors in Transformer-based NLP Models — Rui Zeng
In the evolving landscape of artificial intelligence security, **backdoor attacks** against Natural Language Processing (NLP) models pose a significant and increasingly sophisticated threat. This…
- Try to Poison My Deep Learning Data? Nowhere to Hide Your Trajectory Spectrum! — Yansong Gao
In the rapidly evolving landscape of deep learning, the quality and integrity of training data are paramount, especially for the development of sophisticated models like large language models and…
- DShield: Defending against Backdoor Attacks on Graph Neural Networks via Discrepancy Learning — Hao Yu
Graph Neural Networks (GNNs) have emerged as powerful tools for analyzing complex relational data, finding widespread application in areas like social networks, bioinformatics, and recommender…
- BARBIE: Robust Backdoor Detection Based on Latent Separability — Hanlei Zhang
In an era where deep learning models are becoming ubiquitous across critical domains such as face recognition, machine translation, autonomous driving, and medical diagnosis, their inherent security…
- Welcome to Jurassic Park: A Comprehensive Study of Security Risks in Deno and its Ecosystem — Abdullah AlHamdan
This talk, "Welcome to Jurassic Park: A Comprehensive Study of Security Risks in Deno and its Ecosystem," delivered by Abdullah AlHamdan at the NDSS Symposium, delves into the security landscape of…
- NodeMedic-FINE: Automatic Detection and Exploit Synthesis for Node.js Vulnerabilities — Darion Cassel
In this insightful talk, Darion Cassel introduces NodeMedic-FINE (Node Fine), a sophisticated automated system designed for the detection and exploit synthesis of critical vulnerabilities in Node.js…
- DUMPLING: Fine-grained Differential JavaScript Engine Fuzzing — Liam Wachter
Liam Wachter's presentation at the NDSS Symposium introduced DUMPLING, a novel approach to **fine-grained differential JavaScript engine fuzzing**. The talk addresses a critical security challenge…
- The Midas Touch: Triggering the Capability of LLMs for RM-API Misuse Detection — Yi Yang
This talk, presented by Jinalu (one of the authors) on behalf of Yi Yang, Kachin, and Menlin from the Institute of Information Engineering, Chinese Academy of Sciences, introduces a novel approach…
- Generating API Parameter Security Rules with LLM for API Misuse Detection — Jinghua Liu
In the realm of software development, **Application Programming Interfaces (APIs)** serve as fundamental building blocks, accelerating development cycles and providing diverse functionalities…
- Uncovering the iceberg from the tip: Generating API Specifications for Bug Detection via Specification Propagation Analysis — Miaoqian Lin
In the realm of software security, the correct and safe usage of Application Programming Interfaces (APIs) is paramount. However, the intricate nature of APIs, especially in low-level languages like…
- RadSee: See Your Handwriting Through Walls Using FMCW Radar — Shichen Zhang
In an era where digital interactions dominate, the seemingly anachronistic act of writing by hand might appear to be a bastion of privacy. However, the NDSS Symposium talk "RadSee: See Your…
- Crosstalk-induced Side Channel Threats in Multi-Tenant NISQ Computers — Ruixuan Li
This talk, presented by Namil Churri from the University of Texas at Dallas, in collaboration with the University of Wisconsin Madison, introduces and dissects a novel quantum side channel threat…
- On Borrowed Time – Preventing Static Side-Channel Analysis — Robert Dumitru
In the realm of hardware security, **physical side channel analysis** remains a potent threat, particularly against cryptographic implementations. This talk, "On Borrowed Time," presented by Robert…
- type++: Prohibiting Type Confusion with Inline Type Information — Nicolas Badoux
In the realm of C++ development, the flexibility offered by object-oriented features like inheritance can, paradoxically, introduce significant security vulnerabilities. The talk "type++…
- Translating C To Rust: Lessons from a User Study — Ruishi Li
Memory safety vulnerabilities have long plagued system security, leading to a relentless stream of critical exploits. The C programming language, while foundational, is a primary culprit due to its…
- Retrofitting XoM for Stripped Binaries without Embedded Data Relocation — Chenke Luo
This talk introduces PXOM, a novel approach to implement **Execute-Only Memory (XOM)** for stripped binaries, aiming to significantly enhance defenses against advanced memory disclosure attacks like…
- Enhancing Security in Third-Party Library Reuse – Comprehensive Detection of 1-day Vulnerability through Code Patch Analysis — Shangzhi Xu
This talk presents **Vulture**, an innovative tool designed to enhance security in **third-party library (TPL) reuse** by comprehensively detecting **one-day vulnerabilities** through **code patch…
- CASPR: Context-Aware Security Policy Recommendation — Lifang Xiao
The talk "CASPR: Context-Aware Security Policy Recommendation" introduces an innovative approach to automate and enhance the configuration of security policies, specifically focusing on…
- JBomAudit: Assessing the Landscape, Compliance, and Security Implications of Java SBOMs — Yue Xiao
In an era increasingly defined by complex software supply chain attacks, the talk "JBomAudit: Assessing the Landscape, Compliance, and Security Implications of Java SBOMs" by Yue Xiao at the NDSS…
- MTZK: Testing and Exploring Bugs in Zero-Knowledge (ZK) Compilers — Dongwei Xiao
Dongwei Xiao's talk, "MTZK: Testing and Exploring Bugs in Zero-Knowledge (ZK) Compilers," presented at the NDSS Symposium, addresses a critical and emerging security challenge in the rapidly…
- SHAFT: Secure, Handy, Accurate and Fast Transformer Inference — Andes Y. L. Kei
The proliferation of **Large Language Models (LLMs)** like ChatGPT has ushered in a new era of AI capabilities, yet it has simultaneously amplified concerns regarding data privacy. When users submit…
- Siniel: Distributed Privacy-Preserving zkSNARK — Yunbo Yang
This talk introduces **Siniel**, a novel distributed privacy-preserving **zkSNARK** (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge) system designed to enhance the security and…
- Be Careful of What You Embed: Demystifying OLE Vulnerabilities — Yunpeng Tian
This talk, originally authored by Yunpeng Tian and presented by Senia from Arizona State University, delves into the pervasive and often underestimated security risks associated with **Object…
- From Large to Mammoth: A Comparative Evaluation of Large Language Models in Vulnerability Detection — Jie Lin
This article delves into a comprehensive study presented at the NDSS Symposium, titled "From Large to Mammoth: A Comparative Evaluation of Large Language Models in Vulnerability Detection."…
- Sheep’s Clothing, Wolf’s Data: Detecting Server-Induced Client Vulnerabilities in Windows Remote IPC — Fangming Gu
This talk, presented by Fangming Gu from the Chinese Academy of Science, delves into a critical yet often overlooked area of cybersecurity: **server-induced client-side vulnerabilities** in Windows…
- On the Realism of LiDAR Spoofing Attacks against Autonomous Driving Vehicle at High Speed and Long Distance — Takami Sato
This talk, presented by Rio Suzuki from Ko University and based on joint work with Professor Alfred and Takami Sato from UCI, delves into the critical security vulnerabilities of **LiDAR** (Light…
- Revisiting Physical-World Adversarial Attack on Traffic Sign Recognition: A Commercial Systems Perspective — Ningfei Wang
In an era increasingly reliant on autonomous driving technologies, the robustness of critical perception systems like **Traffic Sign Recognition (TSR)** is paramount. This talk, presented by Ningfei…
- L-HAWK: A Controllable Physical Adversarial Patch Against a Long-Distance Target — Taifeng Liu
The proliferation of AI-powered autonomous systems, particularly in self-driving vehicles, has brought unprecedented levels of automation and safety enhancements to transportation. Central to these…