Home

Person

Mathias Josef Payer

This person has left EPFL

About
Privacy
Disclaimer

Graph Chatbot

Related publications (94)

Page 3 of 5

On the Insecurity of Vehicles Against Protocol-Level Bluetooth Threats

Mathias Josef Payer, Daniele Antonioli

Cars are some of the most security-critical consumer devices. On the one hand, owners expect rich infotainment features, including audio, hands-free calls, contact management, or navigation through their connected mobile phone. On the other hand, the infot ...

IEEE COMPUTER SOC2022

Creating Trust by Abolishing Hierarchies

Mathias Josef Payer, Edouard Bugnion, Evangelos Marios Kogias, Adrien Ghosn, Charly Nicolas Lucien Castes, Yuchen Qian, Neelu Shivprakash Kalani

Software is going through a trust crisis. Privileged code is no longer trusted and processes insufficiently protect user code from unverified libraries. While usually treated separately, confidential computing and program compartmentalization are both symp ...

Association for Computing Machinery2023

Gramatron: Effective Grammar-Aware Fuzzing

Mathias Josef Payer

Fuzzers aware of the input grammar can explore deeper program states using grammar-aware mutations. Existing grammar-aware fuzzers are ineffective at synthesizing complex bug triggers due to: (i) grammars introducing a sampling bias during input generation ...

ASSOC COMPUTING MACHINERY2021

SURGEON: Performant, Flexible, and Accurate Re-Hosting via Transplantation

Mathias Josef Payer, Marcel Busch, Florian Hofhammer

Dynamic analysis of microcontroller-based embedded firmware remains challenging. The general lack of source code availability for Commercial-off-the-shelf (COTS) firmware prevents powerful source-based instrumentation and prohibits compiling the firmware i ...

2024

LIGHTBLUE: Automatic Profile-Aware Debloating of Bluetooth Stacks

Mathias Josef Payer, Daniele Antonioli

The Bluetooth standard is ubiquitously supported by computers, smartphones, and IoT devices. Due to its complexity, implementations require large codebases, which are prone to security vulnerabilities, such as the recently discovered BlueBorne and BadBluet ...

USENIX ASSOC2021

CFIXX: Object Type Integrity for C++

Mathias Josef Payer

C++ relies on object type information for dynamic dispatch and casting. The association of type information to an object is implemented via the virtual table pointer, which is stored in the object itself. As C++ has neither memory nor type safety, adversar ...

The Internet Society2018

HYPERPILL: fuzzing for hypervisor-bugs by leveraging the hardware virtualization interface

Mathias Josef Payer

The security guarantees of cloud computing depend on the isolation guarantees of the underlying hypervisors. Prior works have presented effective methods for automatically identifying vulnerabilities in hypervisors. However, these approaches are limited in ...

USENIX Association2024

Magma: A Ground-Truth Fuzzing Benchmark

Mathias Josef Payer, Ahmad Hazimeh

High scalability and low running costs have made fuzz testing the de facto standard for discovering software bugs. Fuzzing techniques are constantly being improved in a race to build the ultimate bug-finding tool. However, while fuzzing excels at finding b ...

Association for Computing Machinery, Inc2021

PoLPer: Process-Aware Restriction of Over-Privileged Setuid Calls in Legacy Applications

Mathias Josef Payer

setuid system calls enable critical functions such as user authentications and modular privileged components. Such operations must only be executed after careful validation. However, current systems do not perform rigorous checks, allowing exploitation of ...

ASSOC COMPUTING MACHINERY2019

SyzRisk: A Change-Pattern-Based Continuous Kernel Regression Fuzzer

Mathias Josef Payer

Syzbot continuously fuzzes the full Linux kernel to discover latent bugs. Yet, around 75% of recent kernel bugs are caused by recent patches, dubbed regression bugs. Regression fuzzing prioritizes inputs that target recently or frequently patched code. How ...

Association for Computing Machinery, Inc2024

SecureCells: A Secure Compartmentalized Architecture

Andrés Sánchez Marín, Babak Falsafi, Mathias Josef Payer, Siddharth Gupta, Atri Bhattacharyya, Yuanlong Li, Florian Hofhammer

Modern programs are monolithic, combining code of varied provenance without isolation, all the while running on network-connected devices. A vulnerability in any component may compromise code and data of all other components. Compartmentalization separates ...

2023

USBFuzz: A Framework for Fuzzing USB Drivers by Device Emulation

Mathias Josef Payer

The Universal Serial Bus (USB) connects external devices to a host. This interface exposes the OS kernels and device drivers to attacks by malicious devices. Unfortunately, kernels and drivers were developed under a security model that implicitly trusts co ...

USENIX ASSOC2020

Comprehensive Memory Safety Validation: An Alternative Approach to Memory Safety

Mathias Josef Payer

Comprehensive memory safety validation identifies the memory objects whose accesses provably comply with all classes of memory safety, protecting them from memory errors elsewhere at low overhead. We assess the breadth and depth of comprehensive memory saf ...

Ieee Computer Soc2024

One Fuzz Doesn’t Fit All: Optimizing Directed Fuzzing via Target-tailored Program State Restriction

Mathias Josef Payer

Fuzzing is the de-facto default technique to discover software flaws, randomly testing programs to discover crashing test cases. Yet, a particular scenario may only care about specific code regions (for, e.g., bug reproduction, patch or regression testing) ...

ASSOC COMPUTING MACHINERY2022

μsCOPE: A methodology for analyzing least-privilege compartmentalization in large software artifacts

Mathias Josef Payer

By prioritizing simplicity and portability, least-privilege engineering has been an afterthought in OS design, resulting in monolithic kernels where any exploit leads to total compromise. μSCOPE ("microscope") addresses this problem by automatically identi ...

Association for Computing Machinery2021

Spill the TeA: an empirical study of trusted application rollback prevention on android smartphones

Mathias Josef Payer, Marcel Busch

The number and complexity of Trusted Applications (TAs, applications running in Trusted Execution Environments— TEEs) deployed on mobile devices has exploded. A vulnerability in a single TA impacts the security of the entire device. Thus, vendors must rapi ...

USENIX Association2024

CRYSTALLIZER: A Hybrid Path Analysis Framework to Aid in Uncovering Deserialization Vulnerabilities

Mathias Josef Payer, Flavio Toffalini

Applications use serialization and deserialization to exchange data. Serialization allows developers to exchange messages or perform remote method invocation in distributed applications. However, the application logic itself is responsible for security. Ad ...

Assoc Computing Machinery2023

REFLECTA: Reflection-based Scalable and Semantic Scripting Language Fuzzing

Chibin Zhang, Mathias Josef Payer, Gwangmu Lee

Information & Contributors Bibliometrics & Citations References59

Share

Abstract Scripting languages such as Python and JavaScript have revolutionized modern software development thanks to their flexibility and rich functionalities. However, scr ...

ACM2025

VIDEZZO: Dependency-aware Virtual Device Fuzzing

Mathias Josef Payer, Flavio Toffalini, Qiang Liu

A virtual machine interacts with its host environment through virtual devices, driven by virtual device messages, e.g., I/O operations. By issuing crafted messages, an adversary can exploit a vulnerability in a virtual device to escape the virtual machine, ...

Institute of Electrical and Electronics Engineers Inc.2023

Block Oriented Programming: Automating Data-Only Attacks

Mathias Josef Payer

With the widespread deployment of Control-Flow Integrity (CFI), control-flow hijacking attacks, and consequently code reuse attacks, are significantly more difficult. CFI limits control flow to well-known locations, severely restricting arbitrary code exec ...

ASSOC COMPUTING MACHINERY2018