Research Area

Web Security & Privacy (WSP) Lab conducts research on various topics regarding web security and privacy. We envision making Internet services more secure and private by contemplating novel ideas and implementing them in real-world services. Our research topics can be categorized into four research directions:

Representative Works

R1. Analyzing security/privacy risks in Machine Learning (ML) models

Penetration Security Testing of ML Model Vulnerabilities and Defense [IITP 전문연구실]
  • We investigate various security and privacy threats in recent machine learning models and implement tools that assess the robustness of given ML models by conducting penetration security testing.
  • [media]

    R2. Building tools for finding vulnerabilities in server/client-side web applications

    [NDSS'21] The Abuser Inside Apps: Finding the Culprit Committing Mobile Ad Fraud
  • The paper presents the design and implementation of FraudDetective, a dynamic testing frame- work that identifies ad fraud activities. FraudDetective computes a full stack trace from an observed ad fraud activity to a user event by connecting fragmented multiple stack traces, thus generating the causal relationships between user inputs and the observed fraudulent activity. We revised an Android Open Source Project (AOSP) to emit detected ad fraud activities along with their full stack traces, which help pinpoint the app modules responsible for the observed fraud activities. We evaluate FraudDetective on 48,172 apps from Google Play Store. FraudDetective reports that 74 apps are responsible for 34,453 ad fraud activities and find that 98.6% of the fraudulent behaviors originate from embedded third-party ad libraries.

  • [USENIX Security'20] Montage: A Neural Network Language Model-Guided JavaScript Engine Fuzzer
  • JavaScript (JS) engine vulnerabilities pose significant security threats affecting billions of web browsers. In this project, we present Montage, the first NNLM-guided fuzzer for finding JS engine vulnerabilities. The key aspect of our technique is to transform a JS abstract syntax tree (AST) into a sequence of AST subtrees that can directly train prevailing NNLMs. We demonstrate that Montage is capable of generating valid JS tests, and show that it outperforms previous studies in terms of finding vulnerabilities. Montage found 37 real-world bugs, including three CVEs, in the latest JS engines, demonstrating its efficacy in finding JS engine bugs.
  • [paper] [code] [summary]

    [NDSS'20] FUSE: Finding File Upload Bugs via Penetration Testing
  • An Unrestricted Executable File Upload (UEFU) vulnerability is a critical security threat that enables an adversary to upload her choice of a forged file to a target web server and e to conduct remote code execution of this uploaded file via triggering its URL. We design and implement FUSE, a penetration testing tool designed to discover UFU and UEFU vulnerabilities in server-side PHP web applications. The goal of FUSE is to generate upload requests; each request becomes an exploit payload that triggers a UFU or UEFU vulnerability. FUSE discovered 30 previously unreported UEFU vulnerabilities, including 15 CVEs from 33 real-world web applications, thereby demonstrating its efficacy in finding code execution bugs via file uploads.
  • [media] [paper] [code] [summary]

    R3. Finding security/privacy vulnerabilities in web services

    [USENIX WOOT'19] Who Spent My EOS? On the (In)Security of Resource Management of EOS.IO
  • We investigate the design architecture of EOS.IO. Based on this investigation, we introduce four attacks whose root causes stem from the unique characteristics of EOS.IO, including intentionally slowing down the block creation time—which can disrupt the essential functions of its blockchain and incapacitate the entire EOS.IO system. We also find that an adversary can partially freeze the execution of a target smart contract or maliciously consume all the resources of a target user with crafted requests. We report all the identified threats to the EOS.IO foundation, one of which is confirmed to be fatal. Finally, we discuss possible mitigations against the proposed attacks.
  • [paper]

    [CCS'18] Pride and Prejudice in Progressive Web Apps: Abusing Native App-like Features in Web Applications
  • Progressive Web App (PWA) is a new generation of Web application designed to provide native app-like browsing experiences even when a browser is offline. We conduct the first systematic study of the security and privacy aspects unique to PWAs. We identify security flaws in main browsers as well as design flaws in popular third-party push services, that exacerbate the phishing risk. We introduce a new side-channel attack that infers the victim’s history of visited PWAs. The proposed attack exploits the offline browsing feature of PWAs using a cache. We demonstrate a cryptocurrency mining attack which abuses service workers. Defenses and recommendations to mitigate the identified security and privacy risks are suggested with in-depth understanding.
  • [paper] [code]

    R4. Analyzing online scam/criminal activities occurring on the Internet

    [WWW'19] Doppelgängers on the Dark Web: A Large-scale Assessment on Phishing Hidden Web Services
  • We conducted an in-depth measurement study to demystify the prevalent phishing websites on the Dark Web. We analyzed the text content of 28,928 HTTP Tor hidden services hosting 21 million dark webpages and confirmed 901 phishing domains. We also discovered a trend on the Dark Web in which service providers perceive dark web domains as their service brands. This trend exacerbates the risk of phishing for their service users who remember only a partial Tor hidden service address. Our work facilitates a better understanding of the phishing risks on the Dark Web and encourages further research on establishing an authentic and reliable service on the Dark Web.
  • [paper] [summary]