Compromising users account is perhaps the most lucrative attack vectors simply because it presents an entry point for attackers to undermine the security of an otherwise secure system, and cause subsequent harm to users.

Existing breach alerting services from Google, Apple, Microsoft only check if the exact password is leaked, and therefore do not mitigate credential tweaking attacks

MIGP (Might I Get Pwned) is a next-generation password breach altering service to prevent users from picking passwords that are very similar to their prior leaked passwords. By doing do MIGP protects users from credential tweaking attacks where attacker attempts to compromise a user account with variants of a user’s leaked passwords. Recent work has shown credential tweaking attacks can compromise accounts quite effectively even when the credential stuffing countermeasures are in place.

Synced passkeys are a user-friendly solution for account recovery where passkey management services (PMS) from Apple, Google, Microsoft back up users’ FIDO2 private sign- ing keys to their cloud storage. This solution, however, ex- poses passkeys to the potential risk of PMS cloud storage compromise. Unfortunately, existing designs are unable to eliminate such a risk without reintroducing account recovery issues, leaving resulting abuse of leaked passkey difficult to detect.

In this work, we propose a new detection framework, CASPER, which enables websites to detect unauthorized lo- gin attempts by making passkeys stolen from PMS identifiable. Our analysis shows that CASPER provides compelling detection effectiveness, even against attackers who may strategically optimize their attacks to evade CASPER’s detection by leveraging useful information obtained from data breaches that many web services experience today. We also show how to incorporate CASPER seamlessly into the existing passkey backup, synchronization, and authentication processes while introducing only minimal impact on user experience, negli gible performance overhead, and minimum deployment and storage complexity for the participating parties

Spring security is tremendously popular among practitioners for its ease of use to secure enterprise applications. In this paper, we study the application framework misconfiguration vulnerabilities in the light of Spring security, which is relatively understudied in the existing literature.

Towards that goal, we identify 6 types of security anti-patterns and 4 insecure vulnerable defaults by conducting a measurement-based approach on 28 Spring applications. Our analysis shows that security risks associated with the identified security anti-patterns and insecure defaults can leave the enterprise application vulnerable to a wide range of high-risk attacks. To prevent these high-risk attacks, we also provide recommendations for practitioners. Consequently, our study has contributed one update to the official Spring security documentation while other security issues identified in this study are being considered for future major releases by Spring security community.

Secure multi-party computation (MPC) techniques can be used to provide data privacy when users query deep neural network (DNN) models hosted on a public cloud. State-of-the-art MPC techniques can be directly leveraged for DNN models that use simple activation functions such as ReLU. However, these techniques are ineffective and/or inefficient for the complex and highly non-linear activation functions used in cutting-edge DNN models.

We present Compact, which produces piece-wise polynomial approximations of complex activation functions that can be used with state-of-the-art MPC techniques. Compact neither requires nor imposes any restriction on model training and achieves near identical model accuracy. We design Compact with input density awareness and use an application specific simulated annealing type optimization to generate computationally efficient approximations of complex activation functions. We extensively evaluate Compact on four different machine-learning tasks with DNN architectures that use popular complex activation functions SiLU, GeLU, and Mish. Our experimental results show that Compact incurs negligible accuracy loss while being 2×—5× faster than state-of-the-art approaches for DNN models with large number of hidden layers. Our work accelerates easy adoption of MPC techniques to provide user data privacy even when the queried DNN models consist of a number of hidden layers and complex activation functions.

To solve the secure problem for LLMs, in this project, I am working on developing

• a new memory and communication efficient approach to securely evaluate non- linear functions used in LLMs
• a new secure matrix-matrix multiplication protocol

This is a firewall manager from scratch on top of a Linux program named iptables. I use React as frontend and Django as backend. The application was designed to help the network administrators to navigate and manage firewall rules with ease (similar to Cisco firewall manager).