Babak AminAzad
PhD Candidate at Stony Brook UniversityContact
- silverfoxy
- silver7fox
- babakaminazad
- Stony Brook, NY
Web Security
Penetration Testing
-
PHP Static/Dynamic Analysis
-
Courses
Machine Learning
-
Data Science
-
Bots & Automation
Browser & bot automation
-
Analysis of anti-bot mechanisms
-
Mobile Security
Android Mobile Application Penetration Testing
-
Mobile Malware Analysis
-
Malware Detection & Sandboxing
-
iOS 3rd Party Market Analysis
-
About Me
I’m currently a PhD student in PragSec Lab at Stony Brook University. I work under the supervision of Professor Nikiforakis, aiming uncover vulnerabilities and practices, that make the web insecure. More specifically, my research goal is to make web applications safer, by reducing their attack surface through software debloating. In my latest work (published at USENIX security 2019) I showed that we can remove up to 60% of historical CVEs and reduce the size of a web application by 65% while maintaining the most popular functionality of the evaluated web applications. This work requires the dynamic analysis of web applications written in PHP and rewriting parts of their code. Orthogonally to my work on attack surface reduction, I study malicious bots on the internet devising ways to protect websites against them by differentiating their traffic from regular user traffic.
Talks & Publications
-
Less is More: Introducing an Automated Debloating Pipeline based on Dynamic Web Application Usage (Artifacts)
TPCP Software Security Summer School (SSSS '20)
August, 2020 -
Web Runner 2049: Evaluating Third-Party Anti-bot Services (video)
DIMVA 2020 (Won Best Video Presentation Award)
July, 2020 -
Taming The Shape Shifter: Detecting Anti-fingerprinting Browsers (video)
DIMVA 2020
July, 2020 -
Less is More: Web Application Attack Surface Reduction Through Software Debloating (video)
Georgia Tech Cybersecurity Lecture Series
April, 2020 -
Gas What? I can see you GasPots. Studying the fingerprintability of ICS honeypots in the wild
ACSAC 2019, Puerto Rico, USA
December, 2019 -
Less is More: Quantifying the Security Benefits of Debloating Web Applications
OWASP Global AppSec 2019, Washington, D.C, USA
September, 2019 -
Less is More: Quantifying the Security Benefits of Debloating Web Applications (video)
USENIX Security ’19, Santa Clara, CA, USA
August, 2019 -
Fingerprinting users on the web. The good, the bad and the ugly.
P0SCON 2018 Conference, Urmia University of Technology
August, 2018 -
Penetration Testing Methods for Android Applications
1st Offseconf Conference, Khaje Nasir Toosi University
November, 2016 -
Ransomware Threats and Mitigation Techniques
5th Annual Conference on E-Banking and Payment Systems
January, 2016
Service
OWASP Global AppSec San Francisco 2020 Review Committee
Usenix Security 2020 Artifact Evaluation Committee
IEEE S&P'20 Poster Review Committee
External Reviewer at MADWeb 2020
External Reviewer at DIMVA'19
IEEE S&P 2020 Shadow PC
IMC 2019, Shadow PC
NECCDC 2020 Proctor
EDUCATION AND EXPERIENCE
Work Experience
Software Engineer Intern.
Cloudflare ( San Fransisco, US ) 2020 - 2020
I worked with the Bot Management team at Cloudflare as an intern for the summer of 2020. My focus was on bots that target Cloudflare. I implemented a scalable red teaming platform that automated bot attacks against the Bot Management platform.
Research Assistant
PragSec Lab, Stony Brook University ( Stony Brook, NY, USA ) 2018 - PresentTeaching Assistant
Stony Brook University ( Stony Brook, NY, USA ) 2017 - 2018Cyber Security Analyst, Incident Response Team
Kashef Banking Security Governance ( Tehran, Iran ) 2014 - 2016
Website Monitoring and Deface Detection Service:
In this project an application was developed to monitor national banks’ websites and alert the CSIRT team if a downtime or a deface takes place. Important features of this application includes:
This project spanned over 35 national banks’ internet banking websites, SSL protocol configuration of these sites was studied, factors like security against SSL vulnerabilities (Heartbleed, POODLE, FREAK, LogJam etc.), certificate signature algorithm and cipher suites negotiated with clients were taken into consideration and a hardening report was delivered to their admins to address the issues.
Mobile Banking Software Security Report and Secure Android Development Guide:
The android version of mobile banking applications of 35 national banks was studied, features like secure software distribution, frequent updates, tamper detection and integrity verification, secure communication channel to the server, cryptographic protocols, insecure data storage and presence of source code protection was tested, during this study several high impact vulnerabilities were found and reported. Lastly, a secure android development guide was produced to address common pitfalls in applications tested during this study.
In this project an application was developed to monitor national banks’ websites and alert the CSIRT team if a downtime or a deface takes place. Important features of this application includes:
- Monitoring Script addition to the page
- Monitoring redirection to another domain
- Checking for addition of specific words to pages
- Checking for change in the HTML source of website greater than a predefined threshold
- Monitoring DNS records status
- Monitoring WHOIS entry changes and expiration
- Integration with Qualys SSL Labs to produce reports about SSL configuration
This project spanned over 35 national banks’ internet banking websites, SSL protocol configuration of these sites was studied, factors like security against SSL vulnerabilities (Heartbleed, POODLE, FREAK, LogJam etc.), certificate signature algorithm and cipher suites negotiated with clients were taken into consideration and a hardening report was delivered to their admins to address the issues.
Mobile Banking Software Security Report and Secure Android Development Guide:
The android version of mobile banking applications of 35 national banks was studied, features like secure software distribution, frequent updates, tamper detection and integrity verification, secure communication channel to the server, cryptographic protocols, insecure data storage and presence of source code protection was tested, during this study several high impact vulnerabilities were found and reported. Lastly, a secure android development guide was produced to address common pitfalls in applications tested during this study.
Freelance Web Developer
Ontech Solutions ltd., United Kingdom (Remote) ( United Kingdom ) 2013 - 2016
Our task at Ontech was to upgrade a legacy, windows based sector specific ERP
software to a multi user, web based application, this was a web development project
but due to abundance of features it had, the design and implementation of it was
quite a challenge.