Herbert Bos

Professor of Systems Security at @vu5ec / @VUamsterdam

[Herbert Bos @herbertbos]

Leaving Twitter/X. I can't stand the guy.

[Herbert Bos @herbertbos]

@martonbognar @HansWinderix @LeslyAnnDaniel1 @acm_ccs Congrats!

[Herbert Bos @herbertbos]

@MarcusBotacin @AndreasZeller @moyix Yes, looks interesting. Fwiw, one of our students also worked on fuzzing malware:

https://t.co/UlB1LNGSUM

[nSinus-R (@[email protected]) @nSinusR]

Our paper "SIMurai: Slicing Through the Complexity of SIM Card Security Research" just went public!

In this paper, we explore the question: What kind of attacks could a hostile SIM launch against your phone? Surprisingly, a lot.

[Mathias Payer @gannimo]

As it turns out, the secure monitor, Android's most trusted component is full of bugs. @_chli_ and @0ddc0de discovered lots of serious issues @USENIXSecurity though fuzzing. Paper: https://t.co/LBiJF2FXno

[Mathias Payer @gannimo]

Do you want 0days in Android Trusted Applications using the Global Platform API? Use @0ddc0de's binary static analysis @USENIXSecurity to find type confusions resulting in arbitrary writes. Paper: https://t.co/lvH4aB8szX

[Herbert Bos @herbertbos]

In the last @vu5ec presentation at @USENIXSecurity, @hanyrax discusses GhostRace and explains how attackers can exploit speculative race conditions in the Linux kernel.

https://t.co/XfA4N8z3tN

@kurmus
@c_giuffrida
@m4mbr3

[Herbert Bos @herbertbos]

@victor_duta presenting the SafeFetch paper about protecting against double fetches:

https://t.co/ejX3zcKiuG

@vu5ec
@c_giuffrida
@USENIXSecurity
Mitchel Aloserij (not on X?)

[Herbert Bos @herbertbos]

@bjohannesmeyer presenting our Einstein paper that shows that automating data-only attacks can be easy:

https://t.co/ISGEmXVruZ

@vu5ec
@asia_slowinska
@c_giuffrida
@USENIXSecurity

[Herbert Bos @herbertbos]

Happy to report that our InSpectreGadget paper won a Distinguished Paper award at @USENIXSecurity:

https://t.co/Hh4sbo4dM4

@vu5ec @SanWieb @HBitmasks @c_giuffrida

Here is @SanWieb presenting the paper:

[Herbert Bos @herbertbos]

@spendergrsec Maybe we phrased it a bit strongly, without that context. The usenix security paper makes that a bit clearer. Anyway, not intended as a dig at PaX, but a call to *deploy* defenses that stop such attacks.

[Herbert Bos @herbertbos]

@spendergrsec Sorry for late reply - not much X these days. Complexity refers mainly to research that crafts attacks with, say, symbex, and aims for, say, Turing completeness -> neither very practical nor needed. Niche refers to application-specific and requiring much knowledge of application.

[IEEE European Symposium on Security and Privacy @IEEEEUROSP]

A big thank you to the local organizers in Vienna for hosting an outstanding event! Thanks to the outgoing chair @herbertbos and good luck for 2025 to the PC co-chairs @kcotsneb and Anja Lehmann - follow this space for the CfP and changes for the 2025 Venice edition of EuroS&P.

[Herbert Bos @herbertbos]

@kcotsneb @IEEEEUROSP Accurate depiction. True to life.

[Herbert Bos @herbertbos]

So... Andy won the ACM Software System Award for MINIX!

I feel very proud and privileged to have worked with him (on MINIX 3 and other things)! He is one of the true pioneers of operating systems and one of the reasons i came to @VUamsterdam.

https://t.co/guKgU5JBxG

[Kiesraad @Kiesraad]

Europees Parlementsverkiezing voorspoedig verlopen, uitslag betrouwbaar
https://t.co/BoiPbLeaoB

[Kiesraad @Kiesraad]

Zodra de stembussen gesloten zijn, starten de stembureauleden met het tellen van de stemmen. Dit gebeurt in het openbaar en iedereen mag daarbij aanwezig zijn.

Je mag het telproces niet verstoren, dus er gelden enkele regels 👇

[Kiesraad @Kiesraad]

Onze Chief Information Security Officer (CISO) Fleur van Leusden @Queen_fennec mocht in de podcast De Technoloog van BNR Nieuwsradio vertellen over hoe we ervoor zorgen dat de verkiezingen veilig, transparant en controleerbaar zijn.

[Georgios Smaragdakis @GSmaragdakis]

For the first time, 2 @TheOfficialACM flagship conferences in computer systems are colocated in Europe: Rotterdam🎒🚲🌷

ACM ASPLOS'25: https://t.co/X3Co1xu4vq

ACM EuroSys'25: https://t.co/Owod9SRUEg

@tudelft @ugent @VUamsterdam @ACMSIGOPS @sigarch @sigplan @EurosysConf

[Bart Preneel @bpreneel1]

The Belgian presidency has drafted yet another tweaked #chatcontrol proposal. In summary, the proposal remains completely unacceptable. TLDR: All the problems pointed our in our open letters are still there https://t.co/bublijBATW & https://t.co/qb7XIdiB1P 🧵1/6