Research notes
The questions, findings, and implications behind my security research papers.
When a VPN server hosts multiple protocols, a probe-sensitive protocol can expose an otherwise probe-resistant service. Our study examines this weak-link problem across commercial VPN deployments.
IEEE Symposium on Security and Privacy (S&P)
Read postMVPNalyzer audits the security and privacy of Android VPN apps. Our investigation of 281 apps found traffic leaks, unencrypted communication, tracking, and weaknesses in security practices.
Network and Distributed System Security Symposium (NDSS)
Read postPrivate links delivered over SMS can act as bearer credentials. We show how a single exposed URL can reveal sensitive records and, in some services, expand into a much larger leak.
ACM Conference on Computer and Communications Security (CCS)
Read postSpyChain examines how compromised components can threaten small satellite systems, including attacks that span multiple parts of the supply chain and evade testing.
arXiv preprint
Read post