94 citations · 187 across the 19 of their papers we have counts for
15 papers · 1 filter
The Effectiveness of Security Interventions on GitHub
Felix Fischer, Jonas Höbenreich, Jens Grossklags
In 2017, GitHub was the first online open source platform to show security alerts to its users. It has since introduced further security interventions to help developers improve th…
The Benefits of Vulnerability Discovery and Bug Bounty Programs: Case Studies of Chromium and Firefox
Soodeh Atefi, Amutheezan Sivagnanam, Afiya Ayman +2
Recently, bug-bounty programs have gained popularity and become a significant part of the security culture of many organizations. Bug-bounty programs enable organizations to enhanc…
Bug Hunters' Perspectives on the Challenges and Benefits of the Bug Bounty Ecosystem
Omer Akgul, Taha Eghtesad, Amit Elazari +5
Although researchers have characterized the bug-bounty ecosystem from the point of view of platforms and programs, minimal effort has been made to understand the perspectives of th…
Security policy audits: why and how
Arvind Narayanan, Kevin Lee
Information security isn't just about software and hardware -- it's at least as much about policies and processes. But the research community overwhelmingly focuses on the former o…
An Empirical Study of Android Security Bulletins in Different Vendors
Sadegh Farhang, Mehmet Bahadir Kirdan, Aron Laszka +1
Mobile devices encroach on almost every part of our lives, including work and leisure, and contain a wealth of personal and sensitive information. It is, therefore, imperative that…
Analyzing Control Flow Integrity with LLVM-CFI
Paul Muntean, Matthias Neumayer, Zhiqiang Lin +3
Control-flow hijacking attacks are used to perform malicious com-putations. Current solutions for assessing the attack surface afteracontrol flow integrity(CFI) policy was applied…
Hey Google, What Exactly Do Your Security Patches Tell Us? A Large-Scale Empirical Study on Android Patched Vulnerabilities
Sadegh Farhang, Mehmet Bahadir Kirdan, Aron Laszka +1
In this paper, we perform a comprehensive study of 2,470 patched Android vulnerabilities that we collect from different data sources such as Android security bulletins, CVEDetails,…
Economic Analyses of Security Investments on Cryptocurrency Exchanges
Benjamin Johnson, Aron Laszka, Jens Grossklags +1
Cryptocurrency exchanges are frequently targeted and compromised by cyber-attacks, which may lead to significant losses for the depositors and closure of the affected exchanges. Th…
Regulating Access to System Sensors in Cooperating Programs
Giuseppe Petracca, Jens Grossklags, Patrick McDaniel +1
Modern operating systems such as Android, iOS, Windows Phone, and Chrome OS support a cooperating program abstraction. Instead of placing all functionality into a single program, p…
An Economic Study of the Effect of Android Platform Fragmentation on Security Updates
Sadegh Farhang, Aron Laszka, Jens Grossklags
Vendors in the Android ecosystem typically customize their devices by modifying Android Open Source Project (AOSP) code, adding in-house developed proprietary software, and pre-ins…
Practical Integer Overflow Prevention
Paul Muntean, Jens Grossklags, Claudia Eckert
Integer overflows in commodity software are a main source for software bugs, which can result in exploitable memory corruption vulnerabilities and may eventually contribute to powe…
Enemy At the Gateways: A Game Theoretic Approach to Proxy Distribution
Milad Nasr, Sadegh Farhang, Amir Houmansadr +1
A core technique used by popular proxy-based circumvention systems like Tor, Psiphon, and Lantern is to secretly share the IP addresses of circumvention proxies with the censored c…
On the Economics of Ransomware
Aron Laszka, Sadegh Farhang, Jens Grossklags
While recognized as a theoretical and practical concept for over 20 years, only now ransomware has taken centerstage as one of the most prevalent cybercrimes. Various reports demon…
When to Invest in Security? Empirical Evidence and a Game-Theoretic Approach for Time-Based Security
Sadegh Farhang, Jens Grossklags
Games of timing aim to determine the optimal defense against a strategic attacker who has the technical capability to breach a system in a stealthy fashion. Key questions arising a…
Given Enough Eyeballs, All Bugs Are Shallow? Revisiting Eric Raymond with Bug Bounty Programs
Thomas Maillart, Mingyi Zhao, Jens Grossklags +1
Bug bounty programs offer a modern platform for organizations to crowdsource their software security and for security researchers to be fairly rewarded for the vulnerabilities they…