Viewing profile — adamdoupe

If you want to learn offensive security skills, particularly binary analysis, I highly recommend https://pwn.college It's a hands-on class that takes you through interacting with p…

I posted this on the blog but thought I post here too. Last year I set up a WorldWideWeb.app (version 0.15) running in the Previous emulator on Ubuntu for a CTF challenge for DEF C…

Context here means the context of the output page. Usually this means the HTML context. Different sanitization is needed depending on _where_ in the HTML document the input is used…

In our study we didn't differentiate (from a security perspective, if you are vulnerable because you use a WebView when showing ads, then you are still vulnerable), so I don't have…

Sure! The short version is that I don't know. We were looking for instances of insecure WebView usage, so from a security perspective small piece vs. entire app doesn't matter too …

We've studied this and found that ~85% of the free apps on the Google Play store use a WebView (I like the term "mobile web app"): http://adamdoupe.com/publications/large-scale-stu…

Most professor salaries are on 9-month appointments, for the academic year. The three summer months usually come from grants, teaching summer sessions, or consulting. However, a pr…

No. Check out the example in the article, an attacker can make your browser submit a form with a POST request using JavaScript. It's slightly harder to exploit, as the attacker can…

As I remember, the analysis doesn't handle calls that can't be determined statically. So the analysis would fail to determine the method and class of a obfuscated string.

A postdoc in my lab published an academic paper that did exactly this: automated static analysis of iOS compiled binaries for privacy violations. As far as I know Apple was not int…

Link to the full paper for those interested: http://people.csail.mit.edu/rinard/paper/ecoop11.pdf

I've found that it's not the actual code review that's helpful, but preparing for a code review. It forces you to describe the code clearly, which often makes the code clearer in t…

Hey guys, this is some research that some guys in my lab have been doing. Pretty cool stuff, they "took over" the Torpig botnet. Lots of interesting stuff, the paper on the link gi…

> if you're looking for motivation, i highly suggest finding some sport that you enjoy doing. go looking for it, i'm sure one exists. This is exactly what I've done. Rock climbing …

This is the way I use dropbox. I even created a script to install all of my packages and create the proper symlinks. Makes setting up a new computer (frequent occurrence with VM's)…

The featured five on the homepage moves way too fast. It switched when I was still reading. Beyond that, interesting site. Good luck!

On Firefox 1.5 on Linux (It's what they make us use at school), the "points or pay" text extends beyond the tab. http://tinypic.com/view.php?pic=20k3o0z&s=4 But beyond that, I agre…

Can anybody who still uses Digg comment on if this makes Digg worthwhile again (or at least not a waste of time)?

By singing? Actually this was really cool and would be fun to play with.

Steve Yegge's post "Effective Emacs" has instructions for how to do this, plus some other emacs tips: http://steve.yegge.googlepages.com/effective-emacs

I voted this up for two reasons: 1. The article was well written and presented a point of view that is not commonly presented. 2. When I was younger (teenage years I think), I had …