13 citations · 17 across the 10 of their papers we have counts for
11 papers
Beyond the Payload: How User Invocation Shapes Coding Agent Vulnerability to Repository Poisoning
Fukang Zhu, Binbin Zhao, Ruixiao Lin +3
Coding agents are increasingly used for software engineering tasks, including bootstrapping projects from third-party repositories whose integrity cannot be assumed. Prior work on…
Weaver: Fuzzing JavaScript Engines at the JavaScript-WebAssembly Boundary
Lingming Zhang, Binbin Zhao, Puzhuo Liu +4
The security of modern JavaScript (JS) engines is critical since they provide the primary defense mechanism for executing untrusted code on the web. The recent integration of WebAs…
SCRUTINEER: Detecting Logic-Level Usage Violations of Reusable Components in Smart Contracts
Xingshuang Lin, Binbin Zhao, Jinwen Wang +3
Smart Contract Reusable Components(SCRs) play a vital role in accelerating the development of business-specific contracts by promoting modularity and code reuse. However, the risks…
Automatic Red Teaming LLM-based Agents with Model Context Protocol Tools
Ping He, Changjiang Li, Binbin Zhao +2
The remarkable capability of large language models (LLMs) has led to the wide application of LLM-based agents in various domains. To standardize interactions between LLM-based agen…
PROMFUZZ: Leveraging LLM-Driven and Bug-Oriented Composite Analysis for Detecting Functional Bugs in Smart Contracts
Xingshuang Lin, Qinge Xie, Binbin Zhao +6
Smart contracts are fundamental pillars of the blockchain, playing a crucial role in facilitating various business transactions. However, these smart contracts are vulnerable to ex…
FirmRCA: Towards Post-Fuzzing Analysis on ARM Embedded Firmware with Efficient Event-based Fault Localization
Boyu Chang, Binbin Zhao, Qiao Zhang +4
While fuzzing has demonstrated its effectiveness in exposing vulnerabilities within embedded firmware, the discovery of crashing test cases is only the first step in improving the…
SyzTrust: State-aware Fuzzing on Trusted OS Designed for IoT Devices
Qinying Wang, Boyu Chang, Shouling Ji +8
Trusted Execution Environments (TEEs) embedded in IoT devices provide a deployable solution to secure IoT applications at the hardware level. By design, in TEEs, the Trusted Operat…
UVSCAN: Detecting Third-Party Component Usage Violations in IoT Firmware
Binbin Zhao, Shouling Ji, Xuhong Zhang +5
Nowadays, IoT devices integrate a wealth of third-party components (TPCs) in firmware to shorten the development cycle. TPCs usually have strict usage specifications, e.g., checkin…
MINER: A Hybrid Data-Driven Approach for REST API Fuzzing
Chenyang Lyu, Jiacheng Xu, Shouling Ji +6
In recent years, REST API fuzzing has emerged to explore errors on a cloud service. Its performance highly depends on the sequence construction and request generation. However, exi…
One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware
Binbin Zhao, Shouling Ji, Jiacheng Xu +8
Currently, the development of IoT firmware heavily depends on third-party components (TPCs) to improve development efficiency. Nevertheless, TPCs are not secure, and the vulnerabil…
MPInspector: A Systematic and Automatic Approach for Evaluating the Security of IoT Messaging Protocols
Qinying Wang, Shouling Ji, Yuan Tian +8
Facilitated by messaging protocols (MP), many home devices are connected to the Internet, bringing convenience and accessibility to customers. However, most deployed MPs on IoT pla…