Publications

Szu-Chun Huang, Harm Griffioen, Max Van Der Horst, Georgios Smaragdakis, Michel van Eeten, Yury Zhauniarovich. Trust but Verify: An Assessment of Vulnerability Tagging Services. USENIX Security, 2025.

Floris Gorter, Cristiano Giuffrida. RangeSanitizer: Detecting Memory Errors with Efficient Range Checks. USENIX Security, 2025.

Lorenz Kustosch, Carlos Gañán, Michel van Eeten, Simon Parkin. Patching Up: Stakeholder Experiences of Security Updates for Connected Medical Devices. USENIX Security, 2025.

Soufian El Yadmani, Olga Gadyatskaya, Yury Zhauniarovich. The File That Contained the Keys Has Been Removed: An Empirical Analysis of Secret Leaks in Cloud Buckets and Responsible Disclosure Outcomes. IEEE S&P, 2025.

Gerbrand ten Napel, Michel van Eeten, Simon Parkin. Speedrunning the Maze: Meeting Regulatory Patching Deadlines in a Large Enterprise Environment. IEEE S&P, 2025.

Junjian Ye, Xavier De Carné De Carnavalet, Lianying Zhao, Lifa Wu, Mengyuan Zhang. Understanding Home Router Configuration Habits & Attitudes. ACM CHI, 2025.

Marcello Meschini, Giorgio Di Tizio, Marco Balduzzi, Fabio Massacci. A Case-Control Study to Measure Behavioral Risks of Malware Encounters in Organizations. IEEE TIFS, 2024.

Victor Duta, Mitchel Josephus Aloserij, Cristiano Giuffrida. SafeFetch: Practical Double-Fetch Protection with Kernel-Fetch Caching. USENIX Security, 2024.

Brian Johannesmeyer, Asia Slowinska, Herbert Bos, Cristiano Giuffrida. Practical Data-Only Attack Generation. USENIX Security, 2024.

Aksel Ethembabaoglu, Rolf Van Wegberg, Yury Zhauniarovich, Michel van Eeten. The Unpatchables: Why Municipalities Persist in Running Vulnerable Hosts. USENIX Security, 2024.

Berend Kloeg, Aaron Yi Ding, Sjoerd Pellegrom, Yury Zhauniarovich. Charting the Path to SBOM Adoption: A Business Stakeholder-Centric Approach. ACM ASIACCS, 2024.

Francesco Minna, Agathe Blaise, Fabio Massacci, Katja Tuma. Automated Security Repair for Helm Charts. IEEE/ACM ICSE, 2024.

Floris Gorter, Taddeus Kroes, Herbert Bos, Cristiano Giuffrida. Sticky Tags: Efficient and Deterministic Spatial Memory Error Mitigation using Persistent Memory Tags. IEEE S&P, 2024.

Aurora Papotti, Ranindya Paramitha, Fabio Massacci. On the acceptance by code reviewers of candidate security patches suggested by Automated Program Repair tools. Empirical Softwar Engineering, 2024.

Fabio Massacci, Aurora Papotti, Ranindya Paramitha. Addressing Combinatorial Experiments and Scarcity of Subjects by Provably Orthogonal and Crossover Experimental Designs. Elsiever JSS, 2024.

Antonino Sabetta, Serena Elisa Ponta, Rocio Cabrera Lozoya, Michele Bezzi, Tommaso Sacchetti, Matteo Greco, Gergő Balogh, Péter Hegedűs, Rudolf Ferenc, Ranindya Paramitha, Ivan Pashchenko, Aurora Papotti, Ákos Milánkovich, Fabio Massacci. Known Vulnerabilities of Open Source Projects: Where Are the Fixes?. IEEE Security and Privacy, 2024.

Jakob Koschel, Pietro Borrello, Daniele Cono D’Elia, Herbert Bos, Cristiano Giuffrida. UNCONTAINED: Uncovering Container Confusion in the Linux Kernel. USENIX Security, 2023.

Floris Gorter, Enrico Barberis, Raphael Isemann, Erik van der Kouwe, Cristiano Giuffrida, Herbert Bos. FloatZone: Accelerating Memory Error Detection using the Floating Point Unit. USENIX Security, 2023.

Raphael Isemann, Cristiano Giuffrida, Herbert Bos, Erik van der Kouwe, Klaus Von Gleissenthall. Don’t Look UB: Exposing Sanitizer-Eliding Compiler Optimizations. EuroSec, 2023.

Stephanie De Smale, Rik Van Dijk, Xander Bouwman, Jeroen Van Der Ham, Michel van Eeten. No One Drinks From the Firehose: How Organizations Filter and Prioritize Vulnerability Information. IEEE S&P, 2023.

Floris Gorter, Cristiano Giuffrida, Erik van der Kouwe. Enviral: Fuzzing the Environment for Evasive Malware Analysis. EuroSec, 2023.

Victor Duta, Fabian Freyer, Fabio Pagani, Marius Muench, Cristiano Giuffrida. Let Me Unwind That For You: Exceptions to Backward-Edge Protection. NDSS, 2023.

Andrea Di Dio, Koen Koning, Herbert Bos, Cristiano Giuffrida. Copy-on-Flip: Hardening ECC Memory Against Rowhammer Attacks. NDSS, 2023.

Elia Geretto, Cristiano Giuffrida, Herbert Bos, Erik van der Kouwe. Snappy: Efficient Fuzzing with Adaptive and Mutable Snapshots. ACM ACSAC, 2022.

Mannat Kaur, Simon Parkin, Marijn Janssen, Tobias Fiebig. "I needed to solve their overwhelmness": How System Administration Work was Affected by COVID-19. ACM CSCW, 2022.

Floris Gorter, Koen Koning, Herbert Bos, Cristiano Giuffrida. DangZero: Efficient Use-After-Free Detection via Direct Page Table Access. ACM CCS, 2022.

Andrei Tatar, Daniël Trujillo, Cristiano Giuffrida, Herbert Bos. TLB;DR: Enhancing TLB-based Attacks with TLB Desynchronized Reverse Engineering. USENIX Security, 2022.

Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, Cristiano Giuffrida. Branch History Injection: On the Effectiveness of Hardware Mitigations Against Cross-Privilege Spectre-v2 Attacks. USENIX Security, 2022.

Alyssa Milburn, Erik van der Kouwe, Cristiano Giuffrida. Mitigating Information Leakage Vulnerabilities with Type-based Data Isolation. IEEE S&P, 2022.

Brian Johannesmeyer, Jakob Koschel, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida. Kasper: Scanning for Generalized Transient Execution Gadgets in the Linux Kernel. NDSS, 2022.

Xianya Mi, Sanjay Rawat, Cristiano Giuffrida, Herbert Bos. LeanSym: Efficient Hybrid Fuzzing Through Conservative Constraint Debloating. RAID, 2021.