3) Carter Yagemann: Automated Bug Hunting With Data-Driven Symbolic Root Cause Analysis

Presented in-person and onlne via Bluejeans Events on October 22, 2021 at 12:30 p.m in the CODA 9th floor atrium.Jonathan Fuller is a Ph.D. Student in the School of Electrical and Computer Engineering (ECE) at the Georgia Institute of Technology, advised by Dr. Brendan Saltaformaagio in the Cyber Forensics Innovation (CyFi) Lab. My research interests lie in cyber attack forensics, web and IoT security, and malware analysis. His current research aims to combine advanced program analysis techniques and large-scale measurements to explore new methods that target counteractions against botnets.Sena Sahin is a Ph.D. candidate in the School of Cybersecurity and Privacy at Georgia Tech.Carter Yagemann is a Ph.D. candidate in the Institute for Information Security and Privacy at the Georgia Institute of Technology, where I am advised by Prof. Wenke Lee and Prof. Brendan Saltaformaggio. My research interests are in systems and software security, spanning vulnerability discovery via combined program analysis and machine learning, root cause analysis and exploit prevention, and simulation of attacks targeting financial markets.Runtime: 58:48 minutes"c3pO: Large-Scale Study Of Covert Monitoring of C&C Servers via Over-Permissioned Protocol Infiltration", Current techniques to monitor botnets towards disruption or takedown are easily detected and insufficient. Seeking a covert and scalable solution, we look to an evolving pattern in malware that integrates standardized over-permissioned protocols, exposing privileged access to C&C servers. We implement techniques to detect and exploit these protocols from over-permissioned bots. Our findings suggest the over-permissioned protocol weakness provides a scalable approach to covertly monitor C&C servers, which is a fundamental enabler of botnet disruptions and takedowns."Don't Forget the Stuffing! Revisiting the Security Impact of Typo-Tolerant Password Authentication", To enhance the usability of password authentication, typo-tolerant password authentication schemes permit certain deviations in the user-supplied password, to account for common typographical errors yet still allow the user to successfully log in. In prior work, analysis by Chatterjee et al. demonstrated that typo-tolerance indeed notably improves password usability, yet (surprisingly) does not appear to significantly degrade authentication security. In practice, major web services such as Facebook have employed typo-tolerant password authentication systems"Automated Bug Hunting With Data-Driven Symbolic Root Cause Analysis", The increasing cost of successful cyberattacks has caused a mindset shift, whereby defenders now employ proactive defenses, namely software bug hunting, alongside existing reactive measures (firewalls, IDS, IPS) to protect systems. Unfortunately, bug hunting remains laborious and analysts struggle to communicate their discoveries to developers effectively for patching. In this talk, I will present my latest work on a technique I define as symbolic root cause analysis and demonstrate how it can be used to discover and explain novel vulnerabilities in real-world software