Our work on exploring new ways for efficient firmware fuzzing will be published at USENIX Security 2023! With SAFIREFUZZ, we introduce near-native rehosting, drastically improving the performance of fuzzing embedded targets. Super happy about this work w [email protected] nSinus-R (@[email protected])

Our uncontained paper USENIX Security is online! Find out how the Linux kernel is the "container of" several type confusion bugs, detected by our sanitizer & static analyzer. Joint work by Jakob Koschel Pietro Borrello Daniele Cono D'Elia Herbert Bos Cristiano Giuffrida: vusec.net/projects/uncon…

Our FloatZone paper USENIX Security is online: a branchless memory sanitizer that efficiently catches buffer overflows (+ use-after-frees) with floating-point underflows! Joint work by Floris Gorter @Enrico barberis @teemperor Erik van der Kouwe Cristiano Giuffrida Herbert Bos: vusec.net/projects/float…

Our Quarantine RAID Conference paper is online! Quarantine enforces strict CPU core-based isolation to mitigate transient execution attacks vs. cloud VMs. Joint work by Mathé Hertogh Manuel Wiesinger Sebastian Österlund nSinus-R (@[email protected]) Nadav Amit Herbert Bos Cristiano Giuffrida: download.vusec.net/papers/quarant…

Unfortunately, I'm unable to attend USENIX Security and gain insights into the communities opinion on our 2023 artifact evaluation process. Feel free to reply here or provide anonymous feedback here: forms.gle/rJctCc8TgTnKfX… We would like to understand

Phani Vadrevu and I are looking for motivated students and early-career researchers to join the USENIX Security Artifact Evaluation Committee 2024. Help promote the reproducibility in security! Self-nominate before Sep. 28th: forms.gle/zD1jLyXoDMCeUw…

Come work with us in beautiful Amsterdam! We have a new faculty position in Security research Vrije Universiteit Amsterdam. The specific research topic is flexible and synergies with VUSec topics are welcome. Feel free to DM for details. workingat.vu.nl/ad/assistant-p…

We currently have 6 open positions for career track assistant professors at the Vrije Universiteit Amsterdam: workingat.vu.nl/ad/6-assistant… . Note that career track positions grant tenure after a successful noncompetitive evaluation within 18 months.

Reminder: we are hiring! Vrije Universiteit Amsterdam has an open position for an assistant professor in security research (and several other positions also): workingat.vu.nl/ad/assistant-p…

Disclosing #SLAM, aka how to combine Spectre and Intel LAM (& co.) to leak kernel memory on future CPUs (demo below). Thousands of exploitable "unmasked" (or pointer chasing) gadgets in the Linux kernel. Joint work by Mathé Hertogh Sander Wiebing Cristiano Giuffrida: vusec.net/projects/slam

New paper with Pietro Borrello Daniele Cono D'Elia Davide Balzarotti Leonardo Querzoni Cristiano Giuffrida! "Predictive Context-sensitive Fuzzing" introduces compile time context sensitivity to fuzzing w/ selective prioritization using dataflow diversity. Will appear at NDSS24, get it at download.vusec.net/papers/pcsfuzz…

Excited to announce the CfP for #EuroSec2024 — please submit your finest ideas! Deadline: February 14, 2024. #EuroSecWorkshop #Eurosys2024 secopera.eu/eurosec-2024/

Do you have any interesting work in progress in systems security? Negative results? Cool student projects? EuroSec is the perfect place to present it, and offers an excuse to visit Athens and attend EuroSys. Deadline February 14. secopera.eu/eurosec-2024/

How do synchronization primitives work during speculative execution? THEY DON'T! Disclosing #GhostRace (paper USENIX Security). We turn all arch. race-free critical regions of OS/Hypervisors into Speculative Race Conditions. Joint work VUSec IBM Research: vusec.net/projects/ghost…

Branch History Injection (BHI) is back! Disclosing Native BHI, bypassing deployed Spectre-v2/BHI mitigations (e.g., eBPF=off) to leak arbitrary kernel/host memory (e.g., root password hash below). Joint work by Sander Wiebing alvise Herbert Bos Cristiano Giuffrida: vusec.net/projects/nativ…

Do you love low-level systems hacking? And would you like to work at a top systems security research group in Amsterdam? At VUSec, we have a number of PhD and PostDoc positions available: workingat.vu.nl/vacancies/phd-…

Our SafeFetch paper USENIX Security is online! Thanks to an optimized in-kernel cache, SafeFetch provides comprehensive protection against double-fetch bugs at a fraction of the cost of prior solutions. Joint work by Duta Victor, Mitchel, Cristiano Giuffrida: download.vusec.net/papers/safefet…

Today at #SP24, Floris Gorter presents Sticky Tags. We uncover performance/security issues in prior ARM MTE schemes based on random tagging (+ a new speculative oracle) and show how to address them with a new deterministic MTE scheme for spatial memory safety: download.vusec.net/papers/stickyt…

For the first time, 2 Association for Computing Machinery flagship conferences in computer systems are colocated in Europe: Rotterdam🎒🚲🌷 ACM ASPLOS'25: asplos-conference.org/asplos-2025-ca… ACM EuroSys'25: 2025.eurosys.org TU Delft UGent Vrije Universiteit Amsterdam ACM SIGOPS SIGARCH ACM SIGPLAN @EurosysConf

Congratulations to studsec for becoming the first the first Student CyberSecurity Association registered in the Netherlands! And happy to see so many members doing well in our Computer Security Master! linkedin.com/posts/vustudse…