Sheep’s Clothing, Wolf’s Data: Detecting Server-Induced Client Vulnerabilities in Windows Remote IPC
Fangming Gu
Network and Distributed System Security (NDSS) Symposium 2025 · Day 3 · Vulnerability Detection
This talk, presented by Fangming Gu from the Chinese Academy of Science, delves into a critical yet often overlooked area of cybersecurity: **server-induced client-side vulnerabilities** in Windows remote Interprocess Communication (IPC). Traditionally, security research and vulnerability discovery have predominantly focused on the server side, assuming servers are the primary targets and sources of compromise. However, in many remote IPC scenarios, the client application operates with significantly higher privileges than the server it communicates with. If a low-privilege, untrusted server can craft malicious responses that exploit vulnerabilities in a high-privilege client, it can lead to severe security breaches, compromising the client's trust boundary and the machine it runs on.
AI review
Solid original research attacking a genuinely underexplored surface — privileged IPC clients trusting low-privilege server responses. The Gaping framework is methodologically sound, the CVE yield (14 confirmed, $36K bounty) validates the approach, and the snapshot-based fuzzing with LLM-assisted CLI context generation shows real engineering depth. Not a paradigm-shifter, but this is exactly the kind of careful, reproducible systems research that NDSS is built for.