Brad Reaves

AssetHarvester: A Static Analysis Tool for Detecting Secret-Asset Pairs in Software Artifacts

Characterizing Robocalls with Multiple Vantage Points

It Should Be Easy but... New Users' Experiences and Challenges with Secret Management Tools

Fixing Insecure Cellular System Information Broadcasts For Good

Ross, A. J., Reaves, B., Nasser, Y., Cukierman, G., & Jover, R. P. (2024, September 29).

Jäger: Automated Telephone Call Traceback

On SMS Phishing Tactics and Infrastructure

Nahapetyan, A., Prasad, S., Childs, K., Oest, A., Ladwig, Y., Kapravelos, A., & Reaves, B. (2024, May 19). 45TH IEEE SYMPOSIUM ON SECURITY AND PRIVACY, SP 2024, pp. 1–16.

Pairing Security Advisories with Vulnerable Functions Using Open-Source LLMs

Dunlap, T., Meyers, J. S., Reaves, B., & Enck, W. (2024, January 1). Lecture Notes in Computer Science, Vol. 14828, pp. 350–369.

VFCFinder: Pairing Security Advisories and Patches

Dunlap, T., Lin, E., Enck, W., & Reaves, B. (2024, June 28). PROCEEDINGS OF THE 19TH ACM ASIA CONFERENCE ON COMPUTER AND COMMUNICATIONS SECURITY, ACM ASIACCS 2024, pp. 780–794.

A Comparative Study of Software Secrets Reporting by Secret Detection Tools

Finding Fixed Vulnerabilities with Off-the-Shelf Static Analysis

MSNetViews: Geographically Distributed Management of Enterprise Network Security Policy

Anjum, I., Sokal, J., Rehman, H. R., Weintraub, B., Leba, E., Enck, W., … Reaves, B. (2023, May 24). Proceedings of the 28th ACM Symposium on Access Control Models and Technologies, pp. 121–132.

SecretBench: A Dataset of Software Secrets

Towards Simultaneous Attacks on Multiple Cellular Networks

What Challenges Do Developers Face About Checked-in Secrets in Software Artifacts?

Basak, S. K., Neil, L., Reaves, B., & Williams, L. (2023, May 1). 2023 IEEE/ACM 45TH INTERNATIONAL CONFERENCE ON SOFTWARE ENGINEERING, ICSE, pp. 1635–1647.

A Study of Application Sandbox Policies in Linux

Removing the Reliance on Perimeters for Security using Network Views

What are the Practices for Secret Management in Software Artifacts?

A First Look at Scams on YouTube

Presented at the Workshop on Measurements, Attacks, and Defenses for the Web.

Anonymous device authorization for cellular networks

Characterizing the Security of Endogenous and Exogenous Desktop Application Network Flows

Blinded and confused

Hestia

HomeSnitch

How Bad Can It Git? Characterizing Secret Leakage in Public GitHub Repositories

Presented at the Network and Distributed System Security Symposium.

Thou Shalt Discuss Security

A Large Scale Investigation of Obfuscation Use in Google Play

Characterizing the Security of the SMS Ecosystem with Public Gateways

Reaves, B., Vargas, L., Scaife, N., Tian, D., Blue, L., Traynor, P., & Butler, K. R. B. (2018, December 10). ACM Transactions on Privacy and Security.

Sonar: Detecting SS7 Redirection Attacks with Audio-Based Distance Bounding

AuthentiCall: Efficient identity and content authentication for phone calls

Proceedings of the 26th Usenix Security Symposium (USENIX Security '17), 575–592.

FinTechSec: Addressing the Security Challenges of Digital Financial Services

IEEE Security & Privacy, 15(5), 85–89.

Mo(bile) Money, Mo(bile) Problems

ACM Transactions on Privacy and Security, 20(3), 1–31.

Transparent Web Service Auditing via Network Provenance Functions

*droid

ACM Computing Surveys, 49(3), 1–30.

Detecting SMS Spam in the Age of Legitimate Bulk Messaging

Phonion: Practical Protection of Metadata in Telephony Networks

Proceedings on Privacy Enhancing Technologies, 2017(1), 170–187.

Sending Out an SMS: Characterizing the Security of the SMS Ecosystem with Public Gateways

Uncovering Use-After-Free Conditions in Compiled Code

MAST

An open virtual testbed for industrial control system security research

International Journal of Information Security, 11(4), 215–229.

Analysis and mitigation of vulnerabilities in short-range wireless communications for industrial control systems

International Journal of Critical Infrastructure Protection, 5(3-4), 154–174.

A control system testbed to validate critical infrastructure protection concepts

International Journal of Critical Infrastructure Protection, 4(2), 88–103.

On SCADA control system command and response injection and intrusion detection

Discovery, infiltration, and denial of service in a process control system wireless network

Engineering future cyber-physical energy systems: Challenges, research needs, and roadmap