The Bug The Better: Mining Bugs in Complex Programs

Speaker: Flavio Toffalini, Ruhr-Universität Bochum

Abstract: Adversaries continuously exploit vulnerabilities to compromise systems, such as crafting malicious JavaScript programs to hijack Web browsers and obtain remote execution. The most effective strategy for preventing such exploitation, and enhancing system security, is identifying and patching bugs. However, discovering vulnerabilities in modern systems requires facing scalability issues, and dealing with emerging attack surfaces. This presentation will explore cutting-edge advancements in automated software testing, focusing on techniques to maximize the detection of security-critical bugs. Additionally, we will examine new challenges, such as errors injected by compilers into secure code and erroneous code optimization in JavaScript engines.

Biography: Flavio Toffalini is an assistant professor at Ruhr-Universität Bochum (RUB) and holds the Chair for Automated Security Analysis. He works on system security in the context of trusted applications, automated software testing, and exploit mitigation. Specifically, he designs novel testing techniques and explores threats targeting SGX and TEE technologies. His background spans software engineering, mitigation techniques, and bug finding. His work is regularly published in top-tier software engineering and software security venues and has received international recognition. He also serves on the program committees of conferences such as NDSS, USENIX Security, ACSAC, RAID, DIMVA, and ISSTA.

Host: Prof. Marc Langheinrich