6 citations · 21 across the 24 of their papers we have counts for
24 papers
VeriPort: Automated and Verified Patch Backporting at Scale
Jonah Ghebremichael, Wenxin Jiang, Mikola Lysenko +3
One of the key challenges for securing the software supply chain is addressing known vulnerabilities in third-party open-source dependencies. Security patches are frequently only a…
S3C2 Summit 2025-09: Industry Secure Supply Chain Summit
Md Atiqur Rahman, Yasemin Acar, Michel Cucker +5
Today's digital ecosystem relies heavily on software supply chains, which enable developers to reuse code and ship software at scale. However, a single vulnerable component can jeo…
S3C2 Summit 2025-07: Government Secure Supply Chain Summit
Sivana Hamer, Pat Morrison, William Enck +6
Software supply chains, while providing immense economic and software development value, are only as strong as their weakest link. Over the past several years, there has been an ex…
WAAA! Web Adversaries Against Agentic Browsers
Sohom Datta, Alex Nahapetyan, William Enck +1
Large language models (LLMs) are increasingly being integrated into web browsers to create agentic browsing systems that execute actions on behalf of the user. Prior work consideri…
Multi-Agent Taint Specification Extraction for Vulnerability Detection
Jonah Ghebremichael, Saastha Vasan, Saad Ullah +6
Static Application Security Testing (SAST) tools using taint analysis are widely viewed as providing higher-quality vulnerability detection results compared to traditional pattern-…
Towards Verifiably Safe Tool Use for LLM Agents
Aarya Doshi, Yining Hong, Congying Xu +3
Large language model (LLM)-based AI agents extend LLM capabilities by enabling access to tools such as data sources, APIs, search engines, code sandboxes, and even other agents. Wh…
S3C2 SICP Summit 2025-06: Vulnerability Response Summit
Anna Lena Rotthaler, Simon Oberthür, Juraj Somorovsky +9
Recent years have shown increased cyber attacks targeting less secure elements in the software supply chain and causing significant damage to businesses and organizations. The US a…
S3C2 Summit 2025-03: Industry Secure Supply Chain Summit
Elizabeth Lin, Jonah Ghebremichael, William Enck +5
Software supply chains, while providing immense economic and software development value, are only as strong as their weakest link. Over the past several years, there has been an ex…
Characterizing Phishing Pages by JavaScript Capabilities
Aleksandr Nahapetyan, Kanv Khare, Kevin Schwarz +2
Phishers achieve large-scale attacks by using ready-to-deploy phishing websites (phishing kits) to rapidly launch campaigns that leverage specific data exfiltration, evasion, or mi…
SoK: Advances and Open Problems in Web Tracking
Yash Vekaria, Yohan Beugin, Shaoor Munir +11
Web tracking is a pervasive and opaque practice that enables personalized advertising, retargeting, and conversion tracking. Over time, it has evolved into a sophisticated and inva…
S3C2 Summit 2024-09: Industry Secure Software Supply Chain Summit
Imranur Rahman, Yasemin Acar, Michel Cukier +5
While providing economic and software development value, software supply chains are only as strong as their weakest link. Over the past several years, there has been an exponential…
S3C2 Summit 2024-08: Government Secure Supply Chain Summit
Courtney Miller, William Enck, Yasemin Acar +5
Supply chain security has become a very important vector to consider when defending against adversary attacks. Due to this, more and more developers are keen on improving their sup…
Six Million (Suspected) Fake Stars in GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware
Hao He, Haoqin Yang, Philipp Burckhardt +3
GitHub, the de facto platform for open-source software development, provides a set of social-media-like features to signal high-quality repositories. Among them, the star count is…
S3C2 Summit 2023-11: Industry Secure Supply Chain Summit
Nusrat Zahan, Yasemin Acar, Michel Cukier +5
Cyber attacks leveraging or targeting the software supply chain, such as the SolarWinds and the Log4j incidents, affected thousands of businesses and their customers, drawing atten…
FV8: A Forced Execution JavaScript Engine for Detecting Evasive Techniques
Nikolaos Pantelaios, Alexandros Kapravelos
Evasion techniques allow malicious code to never be observed. This impacts significantly the detection capabilities of tools that rely on either dynamic or static analysis, as they…
S3C2 Summit 2024-03: Industry Secure Supply Chain Summit
Greg Tystahl, Yasemin Acar, Michel Cukier +5
Supply chain security has become a very important vector to consider when defending against adversary attacks. Due to this, more and more developers are keen on improving their sup…
Manifest V3 Unveiled: Navigating the New Era of Browser Extensions
Nikolaos Pantelaios, Alexandros Kapravelos
Introduced over a decade ago, Chrome extensions now exceed 200,000 in number. In 2020, Google announced a shift in extension development with Manifest Version 3 (V3), aiming to rep…
S3C2 Summit 2023-06: Government Secure Supply Chain Summit
William Enck, Yasemin Acar, Michel Cukier +3
Recent years have shown increased cyber attacks targeting less secure elements in the software supply chain and causing fatal damage to businesses and organizations. Past well-know…
S3C2 Summit 2023-02: Industry Secure Supply Chain Summit
Trevor Dunlap, Yasemin Acar, Michel Cucker +4
Recent years have shown increased cyber attacks targeting less secure elements in the software supply chain and causing fatal damage to businesses and organizations. Past well-know…
S3C2 Summit 2202-09: Industry Secure Suppy Chain Summit
Mindy Tran, Yasemin Acar, Michel Cucker +4
Recent years have shown increased cyber attacks targeting less secure elements in the software supply chain and causing fatal damage to businesses and organizations. Past well-know…
Categorizing Service Worker Attacks and Mitigations
Karthika Subramani, Jordan Jueckstock, Alexandros Kapravelos +1
Service Workers (SWs) are a powerful feature at the core of Progressive Web Apps, namely web applications that can continue to function when the user's device is offline and that h…
There's No Trick, Its Just a Simple Trick: A Web-Compat and Privacy Improving Approach to Third-party Web Storage
Jordan Jueckstock, Peter Snyder, Shaown Sarker +2
While much current web privacy research focuses on browser fingerprinting, the boring fact is that the majority of current third-party web tracking is conducted using traditional,…
Improving Web Content Blocking With Event-Loop-Turn Granularity JavaScript Signatures
Quan Chen, Peter Snyder, Ben Livshits +1
Content blocking is an important part of a performant, user-serving, privacy respecting web. Most content blockers build trust labels over URLs. While useful, this approach has wel…
The Blind Men and the Internet: Multi-Vantage Point Web Measurements
Jordan Jueckstock, Shaown Sarker, Peter Snyder +4
In this paper, we design and deploy a synchronized multi-vantage point web measurement study to explore the comparability of web measurements across vantage points (VPs). We descri…