Yesterday afternoon I attended a CSE seminar with guest speaker Dr. Yinzhi Cao, who is a Postdoctoral Scientist at Columbia University. The title of his lecture was “Enhancing System Security and Privacy with Program Analysis.” I am interested in the topic of security and the abstract for his seminar grabbed my attention.
“Cyber security and privacy have brought the attention from the general public these days. Melissa Hathaway, who advised both President Obama and President Bush, estimated in a report that governments and consumers lost $125 billion annually to cyber-attacks, including losses in tax revenue. In this talk, from the perspective of program analysis, I will discuss the security and privacy of two important computer systems: Web browser and Android system. In the first part, I will introduce how to prevent and detect drive-by download attacks, which penetrate the boundary of a browser principal. In particular, I will present JShield, a vulnerability-based detection engine that is more robust to obfuscated drive-by download attacks, when compared to various anti-virus software and most recent research papers. In the second part, I will introduce EdgeMiner, the first automatic tool that creates summaries of Android framework in the form of callback and registration pairs. With the summaries, existing static analysis system can correctly construct a control flow graph with hidden control flow dependencies introduced by callback methods.”
Below are some photos I took at the seminar. The last photo is a table with popular antivirus and security software and their detection rate of the drive-by download attacks and additional polluted samples he discussed. He later showed that his JShield software has a 100% rate for both original and polluted samples, which is amazing. I use one of those popular antivirus software and I was surprised and concerned with how vulnerable my system might be.
It was a fantastic seminar, so much so that I went to another seminar presented by Dr. Cao today which I will make another post for in the near future