432 citations · 5.8k across the 150 of their papers we have counts for
6 papers · 1 filter
Maven-Hijack: Software Supply Chain Attack Exploiting Packaging Order
Frank Reyes, Federico Bono, Aman Sharma +2
Java projects frequently rely on package managers such as Maven to manage complex webs of external dependencies. While these tools streamline development, they also introduce subtl…
GoSurf: Identifying Software Supply Chain Attack Vectors in Go
Carmine Cesarano, Vivi Andersson, Roberto Natella +1
In Go, the widespread adoption of open-source software has led to a flourishing ecosystem of third-party dependencies, which are often integrated into critical systems. However, th…
SBOM.EXE: Countering Dynamic Code Injection based on Software Bill of Materials in Java
Aman Sharma, Martin Wittlinger, Benoit Baudry +1
Software supply chain attacks have become a significant threat as software development increasingly relies on contributions from multiple, often unverified sources. The code from u…
XSS-FP: Browser Fingerprinting using HTML Parser Quirks
Erwan Abgrall, Yves Le Traon, Martin Monperrus +3
There are many scenarios in which inferring the type of a client browser is desirable, for instance to fight against session stealing. This is known as browser fingerprinting. This…
In-Vivo Bytecode Instrumentation for Improving Privacy on Android Smartphones in Uncertain Environments
Alexandre Bartel, Jacques Klein, Martin Monperrus +2
In this paper we claim that an efficient and readily applicable means to improve privacy of Android applications is: 1) to perform runtime monitoring by instrumenting the applicati…
Automatically Securing Permission-Based Software by Reducing the Attack Surface: An Application to Android
Alexandre Bartel, Jacques Klein, Martin Monperrus +1
A common security architecture, called the permission-based security model (used e.g. in Android and Blackberry), entails intrinsic risks. For instance, applications can be granted…