20 citations · 39 across the 18 of their papers we have counts for
18 papers
Trust Without Boundaries: An Architectural Analysis of Satellite Flight Software
Jack Vanlyssel, Gruia-Catalin Roman, Kendra Cook +2
As spacecraft become more software-driven and interconnected, onboard flight software is an increasingly important security boundary. Popular flight software architectures often tr…
Attacking the First-Principle: A Black-Box, Query-Free Targeted Mimicry Attack on Binary Function Classifiers
Gabriel Sauger, Jean-Yves Marion, Sazzadur Rahaman +3
Binary function classifiers play a crucial role in maintaining the security and integrity of software systems by detecting malicious code and unauthorized modifications. However, m…
An Evaluation of Chat Safety Moderations in Roblox
Priya Kaushik, Sonja Brown, Rakibul Hasan +1
Roblox is among the most popular online gaming platforms, used by hundreds of millions of users every day. A substantial portion of these users are underage, who are at a greater r…
Revisiting Code Debloating with Ground Truth-based Evaluation
Muhammad Bilal, Moiz Ali, Mohit Kumar +4
Program debloating aims to remove unused code to reduce performance overhead, attack surfaces, and maintenance costs. Over time, debloating has evolved across multiple layers (cont…
GraphQLify: Automated and Type Safety-Preserving GraphQL API Adoption
Saleh Amareen, Arif Rahman, Sazzadur Rahaman +1
GraphQL provides a schema-based, strongly typed query language that enables highly efficient client-server communication. This paper introduces GraphQLify, an automated framework d…
Homoglyph-based Adversarial Perturbation of Introductory Computer Science Theory Problems
Aidan Alexander, Chitrangada Juneja, Napaluck Tontrasathien +4
Different AI tools such as ChatGPT, Gemini, and Claude are becoming very popular. Although they are helpful for many day-to-day tasks, they can be used in unexpected ways. For exam…
The Tragedy of Convenience: Cascading User-Data Leakage from SMS-Delivered URLs
Muhammad Danish, Enrique Sobrados, Priya Kaushik +5
Digital Services are increasingly sending private URLs over Short Message Service (SMS) to allow users to resume sessions with a single click. While convenient, this design shifts…
"It's not approved, but many, like myself, ignore the rule": Investigating the Landscape and Consequences of Unsanctioned Technology Use in Educational Institutes
Easton Kelso, Ananta Soneji, Syed Zami-Ul-Haque Navid +3
Educators regularly use unsanctioned technologies (apps not formally approved by their institutions) for teaching, grading, and other academic tasks. While these tools often suppor…
Investigating the Security & Privacy Risks from Unsanctioned Technology Use by Educators
Easton Kelso, Ananta Soneji, Syed Zami-Ul-Haque Navid +3
Educational technologies are revolutionizing how educational institutions operate. Consequently, it makes them a lucrative target for breach and abuse as they often serve as centra…
Impeding LLM-assisted Cheating in Introductory Programming Assignments via Adversarial Perturbation
Saiful Islam Salim, Rubin Yuchan Yang, Alexander Cooper +3
While Large language model (LLM)-based programming assistants such as CoPilot and ChatGPT can help improve the productivity of professional software developers, they can also facil…
An Investigation into Protestware
Tanner Finken, Jesse Chen, Sazzadur Rahaman
Protests are public expressions of personal or collective discontent with the current state of affairs. Although traditional protests involve in-person events, the ubiquity of comp…
Trust, Because You Can't Verify:Privacy and Security Hurdles in Education Technology Acquisition Practices
Easton Kelso, Ananta Soneji, Sazzadur Rahaman +2
The education technology (EdTech) landscape is expanding rapidly in higher education institutes (HEIs). This growth brings enormous complexity. Protecting the extensive data collec…
On the Contents and Utility of IoT Cybersecurity Guidelines
Jesse Chen, Dharun Anandayuvaraj, James C Davis +1
Cybersecurity concerns of Internet of Things (IoT) devices and infrastructure are growing each year. In response, organizations worldwide have published IoT security guidelines to…
Evaluation of Static Vulnerability Detection Tools with Java Cryptographic API Benchmarks
Sharmin Afrose, Ya Xiao, Sazzadur Rahaman +3
Several studies showed that misuses of cryptographic APIs are common in real-world code (e.g., Apache projects and Android apps). There exist several open-sourced and commercial se…
Bilingual Problems: Studying the Security Risks Incurred by Native Extensions in Scripting Languages
Cristian-Alexandru Staicu, Sazzadur Rahaman, Ágnes Kiss +1
Scripting languages are continuously gaining popularity due to their ease of use and the flourishing software ecosystems that surround them. These languages offer crash and memory…
Coding Practices and Recommendations of Spring Security for Enterprise Applications
Mazharul Islam, Sazzadur Rahaman, Na Meng +4
Spring security is tremendously popular among practitioners for its ease of use to secure enterprise applications. In this paper, we study the application framework misconfiguratio…
Security Certification in Payment Card Industry: Testbeds, Measurements, and Recommendations
Sazzadur Rahaman, Gang Wang, Danfeng +1
The massive payment card industry (PCI) involves various entities such as merchants, issuer banks, acquirer banks, and card brands. Ensuring security for all entities that process…
CryptoGuard: High Precision Detection of Cryptographic Vulnerabilities in Massive-sized Java Projects
Sazzadur Rahaman, Ya Xiao, Sharmin Afrose +6
Cryptographic API misuses, such as exposed secrets, predictable random numbers, and vulnerable certificate verification, seriously threaten software security. The vision of automat…