#brownssl — Public Fediverse posts

📢 Last week, Brown Secure Systems Lab (SSL, https://gitlab.com/brown-ssl/) was at the IEEE Symposium on Security and Privacy (S&P) 2025, where we presented our latest work on hardening OS kernels against attacks that (ab)use heap-based memory-safety vulnerabilities. #IUBIK leverages memory tagging (MTE) and pointer authentication (PA), available in #ARM CPUs, to efficiently and effectively isolate attacker-controlled input from security-critical data in the kernel heap.

👏 Kudos to Marius Momeu (leading author) who did a terrific job presenting our paper -- joint work with Alexander Gaidis (Brown University) and Jasper von der Heidt (Technical University of Munich).

✳️ Paper: https://cs.brown.edu/~vpk/papers/iubik.sp25.pdf

💾 Code: https://github.com/tum-itsec/iubik (coming soon)

#iubik #mte #pac #acm #brownssl #browncs #ieeesp2025

📢 Honored to return to Yale University last week to speak at the Department of Computer Science colloquium on Operating Systems security -- exactly 10 years after my first talk there on the same topic!

In this "tin anniversary" edition, I reflected on how OS kernel exploitation and defense have evolved over the past decade, and shared highlights from some of our recent work in the field over the last five years:

✳️ xMP (IEEE S&P 2020: 📄 https://cs.brown.edu/~vpk/papers/xmp.sp20.pdf, 💾 https://github.com/virtsec/xmp) — Selective intra-kernel memory isolation using hardware-assisted virtualization.

✳️ SafeSLAB (ACM CCS 2024: 📄 https://cs.brown.edu/~vpk/papers/safeslab.ccs24.pdf, 💾 https://github.com/tum-itsec/safeslab) — Kernel heap hardening through memory tagging.

✳️ EPF (USENIX ATC 2023: 📄 https://cs.brown.edu/~vpk/papers/epf.atc23.pdf, 💾 https://gitlab.com/brown-ssl/epf) — Exploiting the (e)BPF sub-system for bypassing modern protections and ways to fix this.

(Joint work with @mikepo, Marius Momeu, Vaggelis Atlidakis, @dijin, and Sergej Proskurin.)

If this area of research interests you, you might also find our recent work on BeeBox (strengthening eBPF against transient execution attacks, USENIX Security 2024: 📄 https://cs.brown.edu/~vpk/papers/beebox.sec24.pdf, 💾 https://gitlab.com/brown-ssl/beebox) and IUBIK (leveraging memory tagging and pointer authentication to isolate attacker-controlled data in kernel space, to appear in IEEE S&P 2025) worth a look.

It was a real pleasure catching up with friends, colleagues, and students. And with the spring weather fully cooperating, I couldn't resist snapping a few photos of Yale's beautiful campus in the early morning light.

Thank you to my host Charalampos Papamanthou and the Yale CS department for the warm welcome and thoughtful discussion!

#xmp #safeslab #epf #brownssl

As we welcome 2025, I'd like to take a moment to reflect on what an extraordinary year 2024 has been for Brown CS Secure Systems Lab (https://gitlab.com/brown-ssl/). It has been a year of innovation, creativity, and growth—both for the lab and for me personally as its director. Witnessing the passion, dedication, and brilliance of our team—Neophytos Christou, Alexander Gaidis, Marius Momeu, @dijin, and Vaggelis Atlidakis—has been truly fulfilling and inspiring!

In 2024, we tackled complex challenges and made significant strides in advancing our research on software hardening and OS kernel protection. Here are some highlights from this remarkable year:

✳️ Marius Momeu presented #SafeSlab at @acm_ccs #CCS2024. Safeslab hardens the Linux SLUB allocator against exploits that abuse use-after-free (#UaF) vulnerabilities, using #Intel #MPK. (Joint work with Technical University of Munich and @mikepo.)
📄 https://cs.brown.edu/~vpk/papers/safeslab.ccs24.pdf
💾 https://github.com/tum-itsec/safeslab

✳️ Neophytos Christou presented #Eclipse at @acm_ccs #CCS2024. Eclipse is a compiler-assisted framework that propagates artificial data dependencies onto sensitive data, preventing the CPU from using attacker-controlled input during speculative execution.
📄 https://cs.brown.edu/~vpk/papers/eclipse.ccs24.pdf
💾 https://gitlab.com/brown-ssl/eclipse

✳️ Di Jin presented #BeeBox at the @usenixassociation Security Symposium 2024. BeeBox hardens #Linux BPF/eBPF against transient execution attacks. #usesec24
📄 https://cs.brown.edu/~vpk/papers/beebox.sec24.pdf
💾 https://gitlab.com/brown-ssl/beebox

✳️ Yaniv David presented #Quack at the NDSS Symposium 2024. Quack hardens PHP code against deserialization attacks using a novel (static) duck typing-based approach. (Joint work with Andreas D Kellas and Junfeng Yang.) #NDSSsymposium2024
📄 https://cs.brown.edu/~vpk/papers/quack.ndss24.pdf
💾 https://github.com/columbia/quack

✳️ Marius Momeu presented #ISLAB at @ACM #ASIACCS24. ISLAB hardens SLAB-based (kernel) allocators, against memory errors, via SMAP-assisted isolation. (Joint work with Technical University of Munich and @mikepo.) #asiaccs
📄 https://cs.brown.edu/~vpk/papers/islab.asiaccs24.pdf
💾 https://github.com/tum-itsec/islab

🏆 #EPF (presented by Di Jin at @usenixassociation #ATC 2023) was the runner-up for the "Bug of the Year" award ("Weirdest Machine" category) at IEEE Symposium on Security and Privacy LangSec (Language-Theoretic Security) workshop 2024! #atc23 #LangSec
⌨️ https://langsec.org/spw24/bugs-of-the-year-awards.html
📄 https://cs.brown.edu/~vpk/papers/epf.atc23.pdf
💾 https://gitlab.com/brown-ssl/epf

🏅 I am honored and delighted to have received the "Distinguished Reviewer Award" at @acm_ccs #CCS2024!

🏅Alexander Gaidis has been awarded the "Distinguished Artifact Reviewer" award at the @usenixassociation Security Symposium 2024!
https://cs.brown.edu/news/2024/09/20/brown-cs-phd-student-alexander-j-gaidis-has-been-named-a-usenix-security-2024-distinguished-artifact-reviewer/
#usesec24 #proudadvisor

📢 I had the great pleasure of discussing some of these works recently at the Computer Systems Seminar at Boston University!
📽️ https://www.bu.edu/rhcollab/events/bu-systems-bu%E2%99%BAs-seminar/

#brownssl #browncs 🚀

📢 @dijin will be presenting our work on hardening #Linux (e)BPF against transient execution attacks at @usenixsecurity '24 tomorrow (Aug. 14, 1:45pm Track 2 -- "Side Channel I: Transient Execution")! Joint work with Alexander J. Gaidis. Paper: https://cs.brown.edu/~vpk/papers/beebox.sec24.pdf | Artifact: https://gitlab.com/brown-ssl/beebox | #brownssl #beebox #ebpf #bpf #usesec24

EPF was the runner-up for the "Bug of the Year" award ("Weirdest Machine" category) at @ieeessp LangSec (Language-Theoretic Security workshop) 2024! https://langsec.org/spw24/bugs-of-the-year-awards.html | #brownssl #epf

Marius Momeu at @ACM ASIA CCS 2024 presenting our work on hardening SLAB-based (kernel) allocators, against memory errors, via SMAP-assisted isolation -- joint work with @tu_muenchen, Sergej Proskurin, and @mikepo | https://cs.brown.edu/~vpk/papers/islab.asiaccs24.pdf | #brownssl #islab

Brown Secure Systems Lab (https://gitlab.com/brown-ssl/) had a strong representation @usenixassociation sponsored events this year! Neophytos Christou presented IvySyn at USENIX Security Symposium (SEC) '23, while Di Jin talked about EPF at USENIX Annual Technical Conference (ATC) '23 earlier in July!

IvySyn fuzzes Deep Learning (DL) frameworks (TensorFlow, PyTorch) for memory-safety bugs and automatically synthesizes Python code snippets for triggering the respective vulnerabilities | https://www.usenix.org/.../usenixse.../presentation/christou | https://gitlab.com/brown-ssl/ivysyn

EPF (ab)uses the (e)BPF interpreter for bypassing various kernel hardening mechanisms in Linux -- we also introduce a set of lightweight defenses against EPF-style attacks | https://www.usenix.org/conference/atc23/presentation/jin | https://gitlab.com/brown-ssl/epf

#brownssl #ivysyn #epf #usenix #atc23 #usesec23

📢 Our work on abusing/hardening the #Linux BPF interpreter for/against kernel exploitation has been accepted at the 2023 @usenixassociation Annual Technical Conference (USENIX ATC)! Joint work with Di Jin and Vaggelis Atlidakis
| https://cs.brown.edu/~vpk/papers/epf.atc23.pdf | #epf #cbpf #ebpf #bpf #atc23 #brownssl