58 citations · 306 across the 21 of their papers we have counts for
14 papers · 1 filter
FuzzingDriver: the Missing Dictionary to Increase Code Coverage in Fuzzers
Arash Ale Ebrahim, Mohammadreza Hazhirpasand, Oscar Nierstrasz +1
We propose a tool, called FuzzingDriver, to generate dictionary tokens for coverage-based greybox fuzzers (CGF) from the codebase of any target program. FuzzingDriver does not add…
Security Header Fields in HTTP Clients
Pascal Gadient, Oscar Nierstrasz, Mohammad Ghafari
HTTP headers are commonly used to establish web communications, and some of them are relevant for security. However, we have only little information about the usage and support of…
Phish What You Wish
Pascal Gadient, Pascal Gerig, Oscar Nierstrasz +1
IT professionals have no simple tool to create phishing websites and raise the awareness of users. We developed a prototype that can dynamically mimic websites by using enriched sc…
Dazed and Confused: What's Wrong with Crypto Libraries?
Mohammadreza Hazhirpasand, Oscar Nierstrasz, Mohammad Ghafari
Recent studies have shown that developers have difficulties in using cryptographic APIs, which often led to security flaws. We are interested to tackle this matter by looking into…
Crypto Experts Advise What They Adopt
Mohammadreza Hazhirpasand, Oscar Nierstrasz, Mohammad Ghafari
Previous studies have shown that developers regularly seek advice on online forums to resolve their cryptography issues. We investigated whether users who are active in cryptograph…
Worrisome Patterns in Developers: A Survey in Cryptography
Mohammadreza Hazhirpasand, Oscar Nierstrasz, Mohammad Ghafari
We surveyed 97 developers who had used cryptography in open-source projects, in the hope of identifying developer security and cryptography practices. We asked them about individua…
Security Smells Pervade Mobile App Servers
Pascal Gadient, Marc-Andrea Tarnutzer, Oscar Nierstrasz +1
[Background] Web communication is universal in cyberspace, and security risks in this domain are devastating. [Aims] We analyzed the prevalence of six security smells in mobile app…
Hurdles for Developers in Cryptography
Mohammadreza Hazhirpasand, Oscar Nierstrasz, Mohammadhossein Shabani +1
Prior research has shown that cryptography is hard to use for developers. We aim to understand what cryptography issues developers face in practice. We clustered 91954 cryptography…
Java Cryptography Uses in the Wild
Mohammadreza Hazhirpasand, Mohammad Ghafari, Oscar Nierstrasz
[Background] Previous research has shown that developers commonly misuse cryptography APIs. [Aim] We have conducted an exploratory study to find out how crypto APIs are used in ope…
Security Smells in Android
Mohammad Ghafari, Pascal Gadient, Oscar Nierstrasz
The ubiquity of smartphones, and their very broad capabilities and usage, make the security of these devices tremendously important. Unfortunately, despite all progress in security…
Tricking Johnny into Granting Web Permissions
Mohammadreza Hazhirpasand, Mohammad Ghafari, Oscar Nierstrasz
We studied the web permission API dialog box in popular mobile and desktop browsers, and found that it typically lacks measures to protect users from unwittingly granting web permi…
Web APIs in Android through the Lens of Security
Pascal Gadient, Mohammad Ghafari, Marc-Andrea Tarnutzer +1
Web communication has become an indispensable characteristic of mobile apps. However, it is not clear what data the apps transmit, to whom, and what consequences such transmissions…
The Impact of Developer Experience in Using Java Cryptography
Mohammadreza Hazhirpasand, Mohammad Ghafari, Stefan Krüger +2
Previous research has shown that crypto APIs are hard for developers to understand and difficult for them to use. They consequently rely on unvalidated boilerplate code from online…
Security Code Smells in Android ICC
Pascal Gadient, Mohammad Ghafari, Patrick Frischknecht +1
Android Inter-Component Communication (ICC) is complex, largely unconstrained, and hard for developers to understand. As a consequence, ICC is a common source of security vulnerabi…