Home

Person

Mathias Josef Payer

This person has left EPFL

About
Privacy
Disclaimer

Graph Chatbot

Related publications (94)

Page 2 of 5

Magma: A Ground-Truth Fuzzing Benchmark

Mathias Josef Payer, Ahmad Hazimeh

High scalability and low running costs have made fuzz testing the de facto standard for discovering software bugs. Fuzzing techniques are constantly being improved in a race to build the ultimate bug-finding tool. However, while fuzzing excels at finding b ...

ASSOC COMPUTING MACHINERY2020

RetroWrite: Statically Instrumenting COTS Binaries for Fuzzing and Sanitization

Mathias Josef Payer

Analyzing the security of closed source binaries is currently impractical for end-users, or even developers who rely on third-party libraries. Such analysis relies on automatic vulnerability discovery techniques, most notably fuzzing with sanitizers enable ...

IEEE COMPUTER SOC2020

MONARCH: a fuzzing framework for distributed file systems

Mathias Josef Payer, Sanidhya Kashyap, Yueyang Pan, Tao Lyu, Zhiyao Feng

Distributed file systems (DFSes) are prone to bugs. Although numerous bug-finding techniques have been applied to DFSes, static analysis does not scalewell with the sheer complexity of DFS codebases while dynamic methods (e.g., regression testing) are limi ...

USENIX Association2024

Code-Pointer Integrity

George Candea, Mathias Josef Payer, Volodymyr Kuznetsov

Systems code is often written in low-level languages like C/C++, which offer many benefits but also delegate memory management to programmers. This invites memory safety bugs that attackers can exploit to divert control flow and compromise the system. Depl ...

2014

Temperature Impact on Remote Power Side-Channel Attacks on Shared FPGAs

Mathias Josef Payer, Mirjana Stojilovic, Ognjen Glamocanin

To answer the growing demand for hardware acceleration, Amazon, Microsoft, and many other major cloud service providers have included field-programmable gate arrays (FPGAs) in their datacenters. However, researchers have shown that cloud FPGAs, when shared ...

IEEE2023

TEEzz: Fuzzing Trusted Applications on COTS Android Devices

Mathias Josef Payer, Marcel Busch

Security and privacy-sensitive smartphone applications use trusted execution environments (TEEs) to protect sensitive operations from malicious code. By design, TEEs have privileged access to the entire system but expose little to no insight into their inn ...

IEEE COMPUTER SOC2023

PROFACTORY: Improving IoT Security via Formalized Protocol Customization

Mathias Josef Payer

As IoT applications gain widespread adoption, it becomes important to design and implement IoT protocols with security. Existing research in protocol security reveals that the majority of disclosed protocol vulnerabilities are caused by incorrectly impleme ...

USENIX ASSOC2022

DatAFLow: Toward a Data-Flow-Guided Fuzzer

Mathias Josef Payer

Coverage-guided greybox fuzzers rely on control-flow coverage feedback to explore a target program and uncover bugs. Compared to control-flow coverage, data-flow coverage offers a more fine-grained approximation of program behavior. Data-flow coverage capt ...

2023

SpecROP: Speculative Exploitation of ROP Chains

Mathias Josef Payer, Atri Bhattacharyya, Andrés Sánchez Marín

Speculative execution attacks, such as Spectre, reuse code from the victim’s binary to access and leak secret information during speculative execution. Every variant of the attack requires very particular code sequences, necessitating elaborate gadget-sear ...

2020

Exploiting android’s hardened memory allocator

Mathias Josef Payer, Marcel Busch

Most memory corruptions occur on the heap. To harden userspace applications and prevent heap-based exploitation, Google has developed Scudo. Since Android 11, Scudo has replaced jemalloc as the default heap implementation for all native code on Android. Sc ...

USENIX Association2024

Fuzzing JavaScript Engines with a Graph-based IR

Mathias Josef Payer

Mutation-based fuzzing effectively discovers defects in JS engines. High-quality mutations are key for the performance of mutation-based fuzzers. The choice of the underlying representation (e.g., a sequence of tokens, an abstract syntax tree, or an interm ...

Association for Computing Machinery, Inc2024

PACMem: Enforcing Spatial and Temporal Memory Safety via ARM Pointer Authentication

Mathias Josef Payer

Memory safety is a key security property that stops memory corruption vulnerabilities. Different types of memory safety enforcement solutions have been proposed and adopted by sanitizers or mitigations to catch and stop such bugs, at the development or dep ...

Association for Computing Machinery2022

BenchIoT: A Security Benchmark for the Internet of Things

Mathias Josef Payer

Attacks against IoT systems are increasing at an alarming pace. Many IoT systems are and will be built using low-cost micro-controllers (IoT-pCs). Different security mechanisms have been proposed for IoT-mu Cs with different trade-offs. To guarantee a real ...

IEEE COMPUTER SOC2019

Preventing Kernel Hacks with HAKC

Mathias Josef Payer

Commodity operating system kernels remain monolithic for practical and historical reasons. All kernel code shares a single address space, executes with elevated processor privileges, and has largely unhindered access to all data, including data irrelevant ...

The Internet Society2022

SoK: Shining Light on Shadow Stacks

Mathias Josef Payer

Control-Flow Hijacking attacks are the dominant attack vector against C/C++ programs. Control-Flow Integrity (CFI) solutions mitigate these attacks on the forward edge, i.e., indirect calls through function pointers and virtual calls. Protecting the backwa ...

IEEE COMPUTER SOC2019

DatAFLow: Toward a Data-flow-guided Fuzzer

Mathias Josef Payer

This Replicating Computational Report (RCR) describes (a) our datAFLow fuzzer and (b) how to replicate the results in "datAFLow: Toward a Data-Flow-Guided Fuzzer." Our primary artifact is the datAFLow fuzzer. Unlike traditional coverage-guided greybox fuzz ...

2023

EL3XIR: fuzzing COTS secure monitors

Mathias Josef Payer, Marcel Busch

ARM TrustZone forms the security backbone of mobile devices. TrustZone-based Trusted Execution Environments (TEEs) facilitate security-sensitive tasks like user authentication, disk encryption, and digital rights management (DRM). As such, bugs in the TEE ...

USENIX Association2024

Top of the Heap: Efficient Memory Error Protection of Safe Heap Objects

Mathias Josef Payer

Heap memory errors remain a major source of software vulnerabilities. Existing memory safety defenses aim at protecting all objects, resulting in high performance cost and incomplete protection. Instead, we propose an approach that accurately identifies ob ...

Association for Computing Machinery, Inc2024

MINERVA: Browser API Fuzzing with Dynamic Mod-Ref Analysis

Mathias Josef Payer

Browser APIs are essential to the modern web experience. Due to their large number and complexity, they vastly expand the attack surface of browsers. To detect vulnerabilities in these APIs, fuzzers generate test cases with a large amount of random API inv ...

Assoc Computing Machinery2022

The Taming of the Stack: Isolating Stack Data from Memory Errors

Mathias Josef Payer

Despite vast research on defenses to protect stack objects from the exploitation of memory errors, much stack data remains at risk. Historically, stack defenses focus on the protection of code pointers, such as return addresses, but emerging techniques to ...

The Internet Society2022