Home

Person

Mathias Josef Payer

About
Privacy
Disclaimer

Graph Chatbot

Related publications (94)

GLeeFuzz: FuzzingWebGL Through Error Message Guided Mutation

WebGL is a set of standardized JavaScript APIs for GPU accelerated graphics. Security of the WebGL interface is paramount because it exposes remote and unsandboxed access to the underlying graphics stack (including the native GL libraries and GPU drivers) ...

Usenix Assoc2023

DatAFLow: Toward a Data-flow-guided Fuzzer

Mathias Josef Payer

This Replicating Computational Report (RCR) describes (a) our datAFLow fuzzer and (b) how to replicate the results in "datAFLow: Toward a Data-Flow-Guided Fuzzer." Our primary artifact is the datAFLow fuzzer. Unlike traditional coverage-guided greybox fuzz ...

2023

One Fuzz Doesn’t Fit All: Optimizing Directed Fuzzing via Target-tailored Program State Restriction

Mathias Josef Payer

Fuzzing is the de-facto default technique to discover software flaws, randomly testing programs to discover crashing test cases. Yet, a particular scenario may only care about specific code regions (for, e.g., bug reproduction, patch or regression testing) ...

ASSOC COMPUTING MACHINERY2022

The Taming of the Stack: Isolating Stack Data from Memory Errors

Mathias Josef Payer

Despite vast research on defenses to protect stack objects from the exploitation of memory errors, much stack data remains at risk. Historically, stack defenses focus on the protection of code pointers, such as return addresses, but emerging techniques to ...

The Internet Society2022

Designing a Provenance Analysis for SGX Enclaves

Mathias Josef Payer, Flavio Toffalini

SGX enclaves are trusted user-space memory regions that ensure isolation from the host, which is considered malicious. However, enclaves may suffer from vulnerabilities that allow adversaries to compromise their trustworthiness. Consequently, the SGX isola ...

ASSOC COMPUTING MACHINERY2022

Midas: Systematic Kernel TOCTTOU Protection

Atri Bhattacharyya, Uros Tesic, Mathias Josef Payer

Double-fetch bugs are a plague across all major operating system kernels. They occur when data is fetched twice across the user/kernel trust boundary while allowing concurrent modification. Such bugs enable an attacker to illegally access memory, cause den ...

2022

On the Insecurity of Vehicles Against Protocol-Level Bluetooth Threats

Mathias Josef Payer, Daniele Antonioli

Cars are some of the most security-critical consumer devices. On the one hand, owners expect rich infotainment features, including audio, hands-free calls, contact management, or navigation through their connected mobile phone. On the other hand, the infot ...

IEEE COMPUTER SOC2022

PROFACTORY: Improving IoT Security via Formalized Protocol Customization

Fei Wang, Mathias Josef Payer, Xiangyu Zhang, Duo Xu

As IoT applications gain widespread adoption, it becomes important to design and implement IoT protocols with security. Existing research in protocol security reveals that the majority of disclosed protocol vulnerabilities are caused by incorrectly impleme ...

USENIX ASSOC2022

BLURtooth: Exploiting Cross-Transport Key Derivation in Bluetooth Classic and Bluetooth Low Energy

Mathias Josef Payer, Daniele Antonioli

Bluetooth is a pervasive wireless technology specified in an open standard. The standard defines Bluetooth Classic (BT) for high-throughput wireless services and Bluetooth Low Energy (BLE) very low-power ones. The standard also specifies security mechanism ...

ASSOC COMPUTING MACHINERY2022

BreakMi: Reversing, Exploiting and Fixing Xiaomi Fitness Tracking Ecosystem

Mathias Josef Payer

Xiaomi is the leading company in the fitness tracking industry. Successful attacks on its fitness tracking ecosystem would result in severe consequences, including the loss of sensitive health and personal data. Despite these relevant risks, we know very l ...

2022

MINERVA: Browser API Fuzzing with Dynamic Mod-Ref Analysis

Mathias Josef Payer, Chijin Zhou, Yu Jiang

Browser APIs are essential to the modern web experience. Due to their large number and complexity, they vastly expand the attack surface of browsers. To detect vulnerabilities in these APIs, fuzzers generate test cases with a large amount of random API inv ...

Assoc Computing Machinery2022

Evocatio: Conjuring Bug Capabilities from a Single PoC

Mathias Josef Payer, Flavio Toffalini

The popularity of coverage-guided greybox fuzzers has led to a tsunami of security-critical bugs that developers must prioritize and fix. Knowing the capabilities a bug exposes (e.g., type of vulnerability, number of bytes read/written) enables prioritizat ...

Association for Computing Machinery2022

PACMem: Enforcing Spatial and Temporal Memory Safety via ARM Pointer Authentication

Mathias Josef Payer

Memory safety is a key security property that stops memory corruption vulnerabilities. Different types of memory safety enforcement solutions have been proposed and adopted by sanitizers or mitigations to catch and stop such bugs, at the development or dep ...

Association for Computing Machinery2022

Deploying Decentralized, Privacy-Preserving Proximity Tracing

Jean-Pierre Hubaux, Sylvain Chatel, Edouard Bugnion, James Richard Larus, Marcel Salathé, Carmela González Troncoso, Wouter Lueks, Mathias Josef Payer, Apostolos Pyrgelis, Theresa Stadler

2022

Preventing Kernel Hacks with HAKC

Mathias Josef Payer

Commodity operating system kernels remain monolithic for practical and historical reasons. All kernel code shares a single address space, executes with elevated processor privileges, and has largely unhindered access to all data, including data irrelevant ...

The Internet Society2022

μsCOPE: A methodology for analyzing least-privilege compartmentalization in large software artifacts

Mathias Josef Payer

By prioritizing simplicity and portability, least-privilege engineering has been an afterthought in OS design, resulting in monolithic kernels where any exploit leads to total compromise. μSCOPE ("microscope") addresses this problem by automatically identi ...

Association for Computing Machinery2021

Evading Voltage-Based Intrusion Detection on Automotive CAN

Rohit Bhatia, Mathias Josef Payer, Duo Xu

The controller area network (CAN) is widely adopted in modern automobiles to enable communications among in-vehicle electronic control units (ECUs). Lacking mainstream network security capabilities due to resource constraints, the CAN is susceptible to the ...

INTERNET SOC2021

Gramatron: Effective Grammar-Aware Fuzzing

Mathias Josef Payer

Fuzzers aware of the input grammar can explore deeper program states using grammar-aware mutations. Existing grammar-aware fuzzers are ineffective at synthesizing complex bug triggers due to: (i) grammars introducing a sampling bias during input generation ...

ASSOC COMPUTING MACHINERY2021

Igor: Crash Deduplication Through Root-Cause Clustering

Ahmad Hazimeh, Mathias Josef Payer

Fuzzing has emerged as the most effective bug-finding technique. The output of a fuzzer is a set of proof-of-concept (PoC) test cases for all observed "unique" crashes. It costs developers substantial efforts to analyze each crashing test case. This, mostl ...

ASSOC COMPUTING MACHINERY2021

Magma: A Ground-Truth Fuzzing Benchmark

Ahmad Hazimeh, Mathias Josef Payer

High scalability and low running costs have made fuzz testing the de facto standard for discovering software bugs. Fuzzing techniques are constantly being improved in a race to build the ultimate bug-finding tool. However, while fuzzing excels at finding b ...

Association for Computing Machinery, Inc2021

Page 3 of 5