papers

Publications (13)

cs.CR2019

CryptoGuard: High Precision Detection of Cryptographic Vulnerabilities in Massive-sized Java Projects

Sazzadur Rahaman, Ya Xiao, Sharmin Afrose +6

Cryptographic API misuses, such as exposed secrets, predictable random numbers, and vulnerable certificate verification, seriously threaten software security. The vision of automat…

cs.CR2021

Privacy Guarantees of BLE Contact Tracing: A Case Study on COVIDWISE

Salman Ahmed, Ya Xiao, Taejoong +5

Google and Apple jointly introduced a digital contact tracing technology and an API called "exposure notification," to help health organizations and governments with contact tracin…

cs.SE2022

Industrial Experience of Finding Cryptographic Vulnerabilities in Large-scale Codebases

Ya Xiao, Yang Zhao, Nicholas Allen +4

Enterprise environment often screens large-scale (millions of lines of code) codebases with static analysis tools to find bugs and vulnerabilities. Parfait is a static code analysi…

cs.CR2021

Evaluation of Static Vulnerability Detection Tools with Java Cryptographic API Benchmarks

Sharmin Afrose, Ya Xiao, Sazzadur Rahaman +3

Several studies showed that misuses of cryptographic APIs are common in real-world code (e.g., Apache projects and Android apps). There exist several open-sourced and commercial se…

cs.CR2020

Security Certification in Payment Card Industry: Testbeds, Measurements, and Recommendations

Sazzadur Rahaman, Gang Wang, Danfeng +1

The massive payment card industry (PCI) involves various entities such as merchants, issuer banks, acquirer banks, and card brands. Ensuring security for all entities that process…

cs.CR2020

Coding Practices and Recommendations of Spring Security for Enterprise Applications

Mazharul Islam, Sazzadur Rahaman, Na Meng +4

Spring security is tremendously popular among practitioners for its ease of use to secure enterprise applications. In this paper, we study the application framework misconfiguratio…