94 citations · 187 across the 19 of their papers we have counts for
21 papers
The Effectiveness of Security Interventions on GitHub
Felix Fischer, Jonas Höbenreich, Jens Grossklags
In 2017, GitHub was the first online open source platform to show security alerts to its users. It has since introduced further security interventions to help developers improve th…
The Benefits of Vulnerability Discovery and Bug Bounty Programs: Case Studies of Chromium and Firefox
Soodeh Atefi, Amutheezan Sivagnanam, Afiya Ayman +2
Recently, bug-bounty programs have gained popularity and become a significant part of the security culture of many organizations. Bug-bounty programs enable organizations to enhanc…
Data Forensics in Diffusion Models: A Systematic Analysis of Membership Privacy
Derui Zhu, Dingfan Chen, Jens Grossklags +1
In recent years, diffusion models have achieved tremendous success in the field of image generation, becoming the stateof-the-art technology for AI-based image processing applicati…
Bug Hunters' Perspectives on the Challenges and Benefits of the Bug Bounty Ecosystem
Omer Akgul, Taha Eghtesad, Amit Elazari +5
Although researchers have characterized the bug-bounty ecosystem from the point of view of platforms and programs, minimal effort has been made to understand the perspectives of th…
Security policy audits: why and how
Arvind Narayanan, Kevin Lee
Information security isn't just about software and hardware -- it's at least as much about policies and processes. But the research community overwhelmingly focuses on the former o…
An Empirical Study of Android Security Bulletins in Different Vendors
Sadegh Farhang, Mehmet Bahadir Kirdan, Aron Laszka +1
Mobile devices encroach on almost every part of our lives, including work and leisure, and contain a wealth of personal and sensitive information. It is, therefore, imperative that…
Analyzing Control Flow Integrity with LLVM-CFI
Paul Muntean, Matthias Neumayer, Zhiqiang Lin +3
Control-flow hijacking attacks are used to perform malicious com-putations. Current solutions for assessing the attack surface afteracontrol flow integrity(CFI) policy was applied…
Hey Google, What Exactly Do Your Security Patches Tell Us? A Large-Scale Empirical Study on Android Patched Vulnerabilities
Sadegh Farhang, Mehmet Bahadir Kirdan, Aron Laszka +1
In this paper, we perform a comprehensive study of 2,470 patched Android vulnerabilities that we collect from different data sources such as Android security bulletins, CVEDetails,…
Economic Analyses of Security Investments on Cryptocurrency Exchanges
Benjamin Johnson, Aron Laszka, Jens Grossklags +1
Cryptocurrency exchanges are frequently targeted and compromised by cyber-attacks, which may lead to significant losses for the depositors and closure of the affected exchanges. Th…
How Reliable is the Crowdsourced Knowledge of Security Implementation?
Mengsu Chen, Felix Fischer, Na Meng +2
Stack Overflow (SO) is the most popular online Q&A site for developers to share their expertise in solving programming issues. Given multiple answers to certain questions, develope…
Regulating Access to System Sensors in Cooperating Programs
Giuseppe Petracca, Jens Grossklags, Patrick McDaniel +1
Modern operating systems such as Android, iOS, Windows Phone, and Chrome OS support a cooperating program abstraction. Instead of placing all functionality into a single program, p…
IntRepair: Informed Repairing of Integer Overflows
Paul Muntean, Martin Monperrus, Hao Sun +2
Integer overflows have threatened software applications for decades. Thus, in this paper, we propose a novel technique to provide automatic repairs of integer overflows in C source…
An Economic Study of the Effect of Android Platform Fragmentation on Security Updates
Sadegh Farhang, Aron Laszka, Jens Grossklags
Vendors in the Android ecosystem typically customize their devices by modifying Android Open Source Project (AOSP) code, adding in-house developed proprietary software, and pre-ins…
Practical Integer Overflow Prevention
Paul Muntean, Jens Grossklags, Claudia Eckert
Integer overflows in commodity software are a main source for software bugs, which can result in exploitable memory corruption vulnerabilities and may eventually contribute to powe…
Enemy At the Gateways: A Game Theoretic Approach to Proxy Distribution
Milad Nasr, Sadegh Farhang, Amir Houmansadr +1
A core technique used by popular proxy-based circumvention systems like Tor, Psiphon, and Lantern is to secretly share the IP addresses of circumvention proxies with the censored c…
On the Economics of Ransomware
Aron Laszka, Sadegh Farhang, Jens Grossklags
While recognized as a theoretical and practical concept for over 20 years, only now ransomware has taken centerstage as one of the most prevalent cybercrimes. Various reports demon…
When to Invest in Security? Empirical Evidence and a Game-Theoretic Approach for Time-Based Security
Sadegh Farhang, Jens Grossklags
Games of timing aim to determine the optimal defense against a strategic attacker who has the technical capability to breach a system in a stealthy fashion. Key questions arising a…
Given Enough Eyeballs, All Bugs Are Shallow? Revisiting Eric Raymond with Bug Bounty Programs
Thomas Maillart, Mingyi Zhao, Jens Grossklags +1
Bug bounty programs offer a modern platform for organizations to crowdsource their software security and for security researchers to be fairly rewarded for the vulnerabilities they…
Aware: Controlling App Access to I/O Devices on Mobile Platforms
Giuseppe Petracca, Ahmad Atamli, Yuqiong Sun +2
Smartphones' cameras, microphones, and device displays enable users to capture and view memorable moments of their lives. However, adversaries can trick users into authorizing mali…
A Game-Theoretic Study on Non-Monetary Incentives in Data Analytics Projects with Privacy Implications
Michela Chessa, Jens Grossklags, Patrick Loiseau
The amount of personal information contributed by individuals to digital repositories such as social network sites has grown substantially. The existence of this data offers unprec…
Near Rationality and Competitive Equilibria in Networked Systems
Nicolas Christin, Jens Grossklags, John Chuang
A growing body of literature in networked systems research relies on game theory and mechanism design to model and address the potential lack of cooperation between self-interested…