13 citations · 21 across the 11 of their papers we have counts for
6 papers · 1 filter
Bulwark: Holistic and Verified Security Monitoring of Web Protocols
Lorenzo Veronese, Stefano Calzavara, Luca Compagna
Modern web applications often rely on third-party services to provide their functionality to users. The secure integration of these services is a non-trivial task, as shown by the…
Can I Take Your Subdomain? Exploring Related-Domain Attacks in the Modern Web
Marco Squarcina, Mauro Tempesta, Lorenzo Veronese +2
Related-domain attackers control a sibling domain of their target web application, e.g., as the result of a subdomain takeover. Despite their additional power over traditional web…
Language-Based Web Session Integrity
Stefano Calzavara, Riccardo Focardi, Niklas Grimm +2
Session management is a fundamental component of web applications: despite the apparent simplicity, correctly implementing web sessions is extremely tricky, as witnessed by the lar…
WPSE: Fortifying Web Protocols via Browser-Side Security Monitoring
Stefano Calzavara, Riccardo Focardi, Matteo Maffei +3
We present WPSE, a browser-side security monitor for web protocols designed to ensure compliance with the intended protocol flow, as well as confidentiality and integrity propertie…
HornDroid: Practical and Sound Static Analysis of Android Applications by SMT Solving
Stefano Calzavara, Ilya Grishchenko, Matteo Maffei
We present HornDroid, a new tool for the static analysis of information flow properties in Android applications. The core idea underlying HornDroid is to use Horn clauses for sound…
A Sound Flow-Sensitive Heap Abstraction for the Static Analysis of Android Applications
Stefano Calzavara, Ilya Grishchenko, Adrien Koutsos +1
The present paper proposes the first static analysis for Android applications which is both flow-sensitive on the heap abstraction and provably sound with respect to a rich formal…