Publications related to Improving systems software security through program analysis and instrumentation

Related publications (32)

Towards Robust and Generalizable Lensless Imaging With Modular Learned Reconstruction

Lensless cameras disregard the conventional design that imaging should mimic the human eye. This is done by replacing the lens with a thin mask, and moving image formation to the digital post-processing. State-of-the-art lensless imaging techniques use lea ...

IEEE-INST ELECTRICAL ELECTRONICS ENGINEERS INC2025

Secure Interface Design Leveraging Hardware/Software Support

Atri Bhattacharyya

Computer systems rely heavily on abstraction to manage the exponential growth of complexity across hardware and software. Due to practical considerations of compatibility between components of these complex systems across generations, developers have favou ...

EPFL2024

X-Attack 2.0: The Risk of Power Wasters and Satisfiability Don’t-Care Hardware Trojans to Shared Cloud FPGAs

Mirjana Stojilovic, Dina Gamaleldin Ahmed Shawky Mahmoud, Beatrice Shokry Samir Shokry

Cloud computing environments increasingly provision field-programmable gate arrays (FPGAs) for their programmability and hardware-level parallelism. While FPGAs are typically used by one tenant at a time, multitenant schemes supporting spatial sharing of c ...

2024

Exploiting android’s hardened memory allocator

Mathias Josef Payer, Marcel Busch

Most memory corruptions occur on the heap. To harden userspace applications and prevent heap-based exploitation, Google has developed Scudo. Since Android 11, Scudo has replaced jemalloc as the default heap implementation for all native code on Android. Sc ...

USENIX Association2024

Design and in vitro Characterization of a Wearable Multisensing System for Hydration Monitoring

Ali Meimandi, Sandro Carrara, Ata Jedari Golparvar, Sarah Tonello

Dehydration is a frequent condition in the elderly and can lead to serious health complications if not compensated timely. Early diagnosis can be problematic, as medical examinations in the hospital would be needed. Fully wearable low-cost multisensing dev ...

Ieee-Inst Electrical Electronics Engineers Inc2024

Formal Foundations of Capture Tracking

Aleksander Slawomir Boruch-Gruszecki

Type systems are a device for verifying properties of programs without running them. Many programming languages used in the industry have always had a type system, while others were initially created without a type system and later adopted one, when the ad ...

EPFL2024

A RISC-V Extension to Minimize Privileges of Enclave Runtimes

Edouard Bugnion, Neelu Shivprakash Kalani

In confidential computing, the view of the system software is Manichean: the host operating system is untrusted and the TEE runtime system is fully trusted. However, the runtime system is often as complex as a full operating system, and thus is not free fr ...

ACM2023

Dynamic Linkers Are the Narrow Waist of Operating Systems

Adrien Ghosn, Charly Nicolas Lucien Castes

While software applications, programming languages, and hardware have changed, operating systems have not. Widely-used commodity operating systems are still modeled after the ones designed in the seventies. The accumulated burden of backward compatibility ...

Association for Computing Machinery2023

Arvin: Greybox Fuzzing Using Approximate Dynamic CFG Analysis

Mathias Josef Payer

Fuzzing has emerged as the most broadly used testing technique to discover bugs. Effective fuzzers rely on coverage to prioritize inputs that exercise new program areas. Edge-based code coverage of the Program Under Test (PUT) is the most commonly used cov ...

ASSOC COMPUTING MACHINERY2023

Silent Bugs Matter: A Study of Compiler-Introduced Security Bugs

Mathias Josef Payer

Compilers assure that any produced optimized code is semantically equivalent to the original code. However, even "correct" compilers may introduce security bugs as security properties go beyond translation correctness. Security bugs introduced by such corr ...

Usenix Assoc2023

A review of the security vulnerabilities and countermeasures in the Internet of Things solutions: A bright future for the Blockchain

Jan Van Herle, Hossein Pourrahmani

The current advances in the Internet of Things (IoT) and the solutions being offered by this technology have accounted IoT among the top ten technologies that will transform the global economy by 2030. IoT is a state-of-the-art paradigm that has developed ...

2023

ACTOR: Action-Guided Kernel Fuzzing

Mathias Josef Payer

Fuzzing reliably and efficiently finds bugs in software, including operating system kernels. In general, higher code coverage leads to the discovery of more bugs. This is why most existing kernel fuzzers adopt strategies to generate a series of inputs that ...

Usenix Assoc2023

Scaling Language Features for Program Verification

Georg Stefan Schmid

Formal verification of real-world software systems remains challenging for a number of reasons, including lack of automation, friction in specifying properties, and limited support for the diverse programming paradigms used in industry. In this thesis we m ...

EPFL2022

Rebooting Virtual Memory with Midgard

Siddharth Gupta

Virtual Memory (VM) is a critical programming abstraction that is widely used in various modern computing platforms. With the rise of datacenter computing and birth of planet-scale online services, the semantic and capacity requirements from memory have ev ...

EPFL2023

Preventing Use-After-Free Attacks with Fast Forward Allocation

Sanidhya Kashyap

Memory-unsafe languages are widely used to implement critical systems like kernels and browsers, leading to thousands of memory safety issues every year. A use-after-free bug is a temporal memory error where the program accidentally visits a freed memory l ...

USENIX ASSOC2021

GLeeFuzz: FuzzingWebGL Through Error Message Guided Mutation

Mathias Josef Payer

WebGL is a set of standardized JavaScript APIs for GPU accelerated graphics. Security of the WebGL interface is paramount because it exposes remote and unsandboxed access to the underlying graphics stack (including the native GL libraries and GPU drivers) ...

Usenix Assoc2023

Exploring brain-inspired multi-core heterogeneous hardware templates for low-power biomedical embedded systems

Benoît Walter Denkinger

The miniaturization of integrated circuits (ICs) and their higher performance and energy efficiency, combined with new machine learning algorithms and applications, have paved the way to intelligent, interconnected edge devices. In the medical domain, they ...

EPFL2023

NrOS: Effective Replication and Sharing in an Operating System

Sanidhya Kashyap

Writing a correct operating system kernel is notoriously hard. Kernel code requires manual memory management and type-unsafe code and must efficiently handle complex, asynchronous events. In addition, increasing CPU core counts further complicate kernel de ...

USENIX ASSOC2021

Rebooting Virtual Memory with Midgard

Babak Falsafi, Mathias Josef Payer, Siddharth Gupta, Atri Bhattacharyya, Yunho Oh, Abhishek Bhattacharjee

Computer systems designers are building cache hierarchies with higher capacity to capture the ever-increasing working sets of modern workloads. Cache hierarchies with higher capacity improve system performance but shift the performance bottleneck to addres ...

2021

Anonymous Tokens with Stronger Metadata Bit Hiding from Algebraic MACs

Serge Vaudenay, Fatma Betül Durak

On the one hand, the web needs to be secured from malicious activities such as bots or DoS attacks; on the other hand, such needs ideally should not justify services tracking people's activities on the web. Anonymous tokens provide a nice tradeoff between ...

2023