The Web Security Seminar

The Web Security Seminar

For registration, please apply for this seminar through the central seminar assignment system.

The Web Security Seminar will teach students to present, analyze, discuss, and summarize papers in different areas of Web security. The seminar combines a reading group with (almost) weekly meetings and a regular seminar, where students will write a seminar paper.

Each student will get a topic assigned, consisting of a lead and a follow-up paper. The student will present the follow-up paper in a 20-minute presentation followed by a 10-minute Q&A. Afterwards we will all discuss the lead paper as a reading group. All students must read the lead paper and, before each session, must submit a summary with strengths and weaknesses.

Finally, each student will write a seminar paper on the assigned topic, for which the two papers serve as the starting point. Special attention should be paid at fulfilling the seminar paper's objective.

New this years: Any use of LLMs/GenAI is strictly forbidden for producing or polishing the text of the seminar papers. We will thoroughly investigate any suspicious text we find in the submitted manuscripts, e.g., via an oral exam in which the student is invited to explain the text.

 

Important Details

• Kickoff on Monday, 21.10.2024, 10:15-12:00, CISPA main building, room 0.07
• (Semi) Regular seminar sessions on Mondays. First session is on Monday, 04.11.2024, 10:15-12:00
• Each Friday at 11:59 before each session, submit the paper summary (one page max) with discussion points: three items for the strengths, three items for the weaknesses, and future work
• Optional feedback round before your session (arrange exact time with your supervisor)
• Attendance in all meetings and submission of summary and discussion points for each topic is mandatory. For exceptional cases, contact the teaching staff.

• Note that we will not offer a hybrid solution: We plan to have in-person, weekly, seminar meetings during the semester.

 

Seminar Paper Details

We will cover the different types of seminar paper during the kickoff session.

All seminar papers are due on (see below). Based on your submission, you will receive feedback within one week and have until (see below) to improve your paper. The paper grading will be on the final version. Note that the first submission must already be sufficient to pass. If you submit a half-baked version of the paper, you will likely fail the course.

Each paper must use the provided template and all the text must be written via Overleaf in a project monitored by the organizers of the seminar. It must not be longer than 8 pages, not counting references and appendices. Note that appendices are not meant to provide information that is absolutely necessary to understand the paper, but rather to provide auxiliary material. Papers can be shorter, but in general the provided page limit is a good indicator of how long a paper should be.

 

Schedule, List of Topics, and Papers

Date	Time	Content	Tutor	Main paper (discussed)	Follow-up papers (presented)
21.10.24	10:15-12:00	Kickoff	-	-	-
28.10.24		(break)
04.11.24 (Different room: 2.22)	10:15-12:00	Security and Privacy Implications of JavaScript Bundling (Xuenan)	Cris	Jack-in-the-box: An Empirical Study of JavaScript Bundling on the Web and its Security Implications	Unbundle-Rewrite-Rebundle: Runtime Detection and Rewriting of Privacy-Harming Code in JavaScript Bundles
11.11.24	10:15-12:00	Browser Extensions Fingerprinting (Moritz)	Shubham	Peeking through the window: Fingerprinting Browser Extensions through Page-Visible Execution Traces and Interactions	Escaping the Confines of Time: Continuous Browser Extension Fingerprinting Through Ephemeral Modifications
18.11.24	10:15-12:00	Detection of Malicious Web Extensions (Abdullah Hassan)	Valentino	Mystique: Uncovering Information Leakage from Browser Extensions	You’ve Changed: Detecting Malicious Browser Extensions through their Update Deltas
25.11.24	10:15-12:00	(Geo)Location-based Accessibility Hurdles (Mohammad Nomaan Nasir)	Masud	Digital Discrimination of Users in Sanctioned States: The Case of the Cuba Embargo	Measuring the Deployment of Network Censorship Filters at Global Scale
02.12.24	10:15-12:00	Access Control Vulnerabilities in Web Applications (John Paul)	Alex	Finding Access Control Bugs in Web Applications with CanCheck	Automated Black Box Detection of HTTP GET Request-based Access Control Vulnerabilities in Web Applications
09.12.24 (Different room: SR 5 (011) in E2 4)	10:15-12:00	The LoggedIn Web: A New Security Frontier (Vaishnavi)	Jannis	To Auth or Not To Auth? A Comparative Analysis of the Pre- and Post-Login Security Landscape	A Large-Scale Measurement of Website Login Policies
16.12.24	10:15-12:00	Type Confusion in Gradually Typed Languages (Marcel)	Dominic	Typed and Confused: Studying the Unexpected Dangers of Gradual Typing	TypeDevil: Dynamic Type Inconsistency Analysis for JavaScript
23.12.24		(break)
30.12.24		(break)
06.01.25	10:15-12:00	Drafts Discussion
13.01.25	10:15-12:00	Web Security for Visually Impaired Users (Manish Kumar)	Andrea	A Research Framework and Initial Study of Browser Security for the Visually Impaired	"I'm Literally Just Hoping This Will Work: " Obstacles Blocking the Online Security and Privacy of Users with Visual Disabilities
20.01.25	10:15-12:00	Phishing Detection (Abigail)	Giada	Knowledge Expansion and Counterfactual Interaction for Reference-Based Phishing Detection	KnowPhish: Large Language Models Meet Multimodal Knowledge Graphs for Enhancing Reference-Based Phishing Detection
27.01.25	10:15-12:00	Security of Emerging JavaScript Runtimes (Fouad)	Abdullah	Welcome to Jurassic Park: A Comprehensive Study of Security Risks in Deno and its Ecosystem (only for Vaishnavi to read)	GHunter: Universal Prototype Pollution Gadgets in JavaScript Runtimes
03.02.25	10:15-12:00	Automatic Exploit Generation (Aleeza Suhel)	Dominic	Test Suites Guided Vulnerability Validation for Node.js Applications	NODEMEDIC-FINE: Automatic Detection and Exploit Synthesis for Node.js Vulnerabilities