Yan Shoshitaishvili - CV
Yan Shoshitaishvili - CV
edu
(520) 305-9267
Pushing forward the world of Cybersecurity. @Zardus
Education
2017 PhD in Computer Science from the University of California, Santa Barbara.
Advisors: Giovanni Vigna and Christopher Kruegel
Dissertation: Building a Base for Cyber-autonomy
Professional Appointments
2017 - Present Assistant Professor, Arizona State University.
2022 - Present Acting and Associate Director, Center for Cybersecurity and Trusted
Foundations, Arizona State University.
Research Funding
DARPA YFA (Young Faculty Award): Shining Light on Occluded Vulnerabilities,
2022-2025 $996,241, PI.
ONR Binary Trimming for Improved Security, $1,990,042, co-PI (w/ Giovanni Vigna,
2017-2022 Christopher Kruegel), $653,464 share.
MITRE LATCH: Live Binary Analysis and Patching, $150,000, PI (w/ Ruoyu Wang).
2020-2021
◌ Erik Trickel, Fabio Pagani, Chang Zhu, Lukas Dresel, Giovanni Vigna, Christopher Kruegel,
Ruoyu Wang, Tiffany Bao, Yan Shoshitaishvili, Adam Doupe. Toss a Fault to Your Witcher:
Applying Grey-box Coverage-Guided Mutational Fuzzing to Detect SQL and Command
Injection Vulnerabilities. IEEE Security and Privacy 2023.
◌ Penghui Zhang, Zhibo Sun, Sukwha Kyung, Hans Behrens, Zion Leonahenahe Basque,
Haehyun Cho, Adam Oest, Ruoyu Wang, Tiffany Bao, Yan Shoshitaishvili, Gail-Joon Ahn,
Adam Doupe. I’m SPARTACUS, No, I’m SPARTACUS: Proactively Protecting Users From
Phishing by Intentionally Triggering Cloaking Behavior. ACM CCS 2022.
◌ Soroush Karami, Faezeh Kalantari, Mehrnoosh Zaeifi, Xavier Jeremy Maso, Erik Trickel,
Panagiotis Ilia, Yan Shoshitaishvili, Adam Doupe, Jason Polakis. Unleash the Simulacrum:
Shifting Browser Realities for Robust Extension-Fingerprinting Prevention. USENIX Security
2022.
◌ Kyle Zeng, Yueqi Chen, Haehyun Cho, Xinyu Xing, Adam Doupe, Yan Shoshitaishvili,
Tiffany Bao. Playing for K(H)eaps: Understanding and Improving Linux Kernel Exploit
Reliability. USENIX Security 2022.
◌ Jayakrishna Menon Vadayath, Moritz Eckert, Kyle Zeng, Nicolaas Weideman, Gokulkrishna
Praveen Menon, Yanick Fratantonio, Davide Balzarotti, Adam Doupé, Tiffany Bao, Ruoyu
Wang, Christophe Hauser, Yan Shoshitaishvili. Arbiter: Bridging the Static and Dynamic
Divide in Vulnerability Discovery on Binary Programs. USENIX Security 2022.
◌ Ananta Soneji, Faris Bugra Kokulu, Carlos Rubio-Medrano, Tiffany Bao, Ruoyu Wang, Yan
Shoshitaishvili, Adam Doupe. “Flawed, but like democracy we don’t have a better system”:
The Experts’ Insights on the Peer Review Process of Evaluating Security Papers. IEEE
Security and Privacy 2022.
◌ Haehyun Cho, Jinbum Park, Adam Oest, Tiffany Bao, Ruoyu (Fish) Wang, Yan
Shoshitaishvili, Adam Doupe, Gail-Joon Ahn. ViK: Practical Mitigation of Temporal Memory
Safety Violations through Object ID Inspection. ACM ASPLOS 2022.
◌ Zhibo Sun, Adam Oest, Penghui Zhang, Carlos Rubio-Medrano, Tiffany Bao, Ruoyu Wang,
Ziming Zhao, Yan Shoshitaishvili, Adam Doupe, Gail-Joon Ahn. Having Your Cake and
Eating It: An Analysis of Concession-Abuse-as-a-Service, USENIX Security 2021.
◌ Penghui Zhang, Adam Oest, Haehyun Cho, Zhibo Sun, RC Johnson, Brad Wardman,
Shaown Sarker, Alexandros Kapravelos, Tiffany Bao, Ruoyu Wang, Yan Shoshitaishvili,
Adam Doupé, Gail-Joon Ahn. CrawlPhish: Large-scale Analysis of Client-side Cloaking
Techniques in Phishing. IEEE Security and Privacy 2021 - Best Student Paper Award.
◌ Sung Ta Dinh, Haehyun Cho, Kyle Martin, Adam Oest, Kyle Zeng, Alexandros Kapravelos,
Gail-Joon Ahn, Tiffany Bao, Ruoyu Wang, Adam Doupé, Yan Shoshitaishvili. Favocado:
Fuzzing the Binding Code of JavaScript Engines Using Semantically Correct Test Cases,
NDSS 2021.
◌ Adam Oest, Yeganeh Safaei, Penghui Zhang, Brad Wardman, Kevin Tyers, Yan
Shoshitaishvili, Adam Doupé, Gail-Joon Ahn. PhishTime: Continuous Longitudinal
Measurement of the Effectiveness of Anti-phishing Blacklists. USENIX Security 2020.
◌ Haehyun Cho, Jinbum Park, Donguk Kim, Ziming Zhao, Yan Shoshitaishvili, Adam Doupe,
Gail-Joon Ahn. SmokeBomb: Effective Mitigation Against Cache Side-channel Attacks on
the ARM Architecture, ACM MobiSys 2020.
◌ Nilo Redini, Aravind Machiry, Ruoyu Wang, Chad Spensky, Andrea Continella, Yan
Shoshitaishvili, Giovanni Vigna, Christopher Kruegel. KARONTE: Detecting Insecure
Multi-binary Interactions in Embedded Firmware, IEEE Security and Privacy 2020.
◌ Faris Kokulu, Ananta Soneji, Tiffany Bao, Yan Shoshitaishvili, Ziming Zhao, Adam Doupé,
Gail-Joon Ahn. Matched and Mismatched SOCs: A Qualitative Study on Security Operations
Center Issues, ACM CCS 2019.
◌ Vaibhav Dixit, Sukwha Kyung, Ziming Zhao, Adam Doupé, Yan Shoshitaishvili, Gail-Joon
Ahn. AIM-SDN: Attacking Information Mismanagement in SDN-datastores, ACM CCS 2018.
◌ Moritz Eckert, Antonio Bianchi, Ruoyu Wang, Yan Shoshitaishvili, Christopher Kruegel,
Giovanni Vigna. Heaphopper: bringing bounded model checking to heap implementation
security, Usenix Security 2018.
◌ Hui Peng, Yan Shoshitaishvili, Mathias Payer. T-Fuzz: fuzzing by program transformation.
IEEE Security and Privacy 2018.
◌ Yan Shoshitaishvili, Michael Weissbacher, Lukas Dresel, Christopher Salls, Ruoyu Wang,
Christopher Kruegel, Giovanni Vigna. Rise of the HaCRS: Augmenting Automated Cyber
Reasoning Systems with Human Assistance. ACM CCS 2017.
◌ Jacob Corina, Aravind Machiry, Christopher Salls, Yan Shoshitaishvili, Shuang Hao,
Christopher Kruegel, Giovanni Vigna. DIFUZE: Interface Aware Fuzzing for Kernel Drivers.
ACM CCS 2017.
◌ Nilo Redini, Aravind Machiry, Dipanjan Das, Yanick Fratantonio, Antonio Bianchi, Eric
Gustafson, Yan Shoshitaishvili, Christopher Kruegel, and Giovanni Vigna. BootStomp: On
the Security of Bootloaders in Mobile Devices. Usenix Security 2017.
◌ Tiffany Bao, Ruoyu Wang, Yan Shoshitaishvili, David Brumley. Your Exploit is Mine:
Automatic Shellcode Transplant for Remote Exploits. IEEE Security and Privacy 2017.
◌ Ruoyu Wang, Yan Shoshitaishvili, Antonio Bianchi, Aravind Machiry, John Grosen, Paul
Grosen, Christopher Kruegel, Giovanni Vigna. Ramblr: Making Binaries Great Again. NDSS
2017 - Distinguished Paper Award.
◌ Yan Shoshitaishvili, Ruoyu Wang, Chris Salls, Nick Stephens, Mario Polino, Audrey Dutcher,
John Grosen, Siji Feng, Christophe Hauser, Christopher Kruegel, Giovanni Vigna. SoK:
(State of the) Art of War: Offensive Techniques in Binary Analysis. IEEE Security and
Privacy 2016.
◌ Nick Stephens, John Grosen, Chris Salls, Audrey Dutcher, Ruoyu Wang, Jacopo Corbetta,
Yan Shoshitaishvili, Christopher Kruegel, Giovanni Vigna. Driller: Augmenting Fuzzing
Through Symbolic Execution. NDSS 2016.
◌ Tiffany Bao and Yan Shoshitaishvili. Cyber Autonomy in Software Security: Techniques and
Tactics (Book Chapter). In Game Theory and Machine Learning for Cyber Security, 2021.
◌ Yan Shoshitaishvili, et al. Cyber Grand Shellphish. Phrack Volume 70, 2021.
◌ Mauricio Gutierrez, Ziming Zhao, Adam Doupé, Yan Shoshitaishvili, Gail-Joon Ahn.
Mitigating the CACHEKIT Attack. Frontiers in Hardware Security and Trust: Theory,
Design and Practice 2020.
◌ Yan Shoshitaishvili, Antonio Bianchi, Kevin Borgolte, Amat Cama, Jacopo Corbetta,
Francesco Disperati, Audrey Dutcher, John Grosen, Paul Grosen, Aravind Machiry, Chris
Salls, Nick Stephens, Ruoyu Wang, Giovanni Vigna. Mechanical Phish: Resilient
Autonomous Hacking. IEEE Security and Privacy Magazine 2018.
Awards
🥇 ASU's Fulton Schools of Engineering awarded me the Top 5% Teaching Award for the
2021-2022 school year!
🥇 The IEEE Security and Privacy 2021 program committee awarded CrawlPhish: Large-scale
Analysis of Client-side Cloaking Techniques in Phishing the Best Student Paper award.
🥇 Our paper, How Shall We Play a Game?, won the 2018 NSA Cybersecurity paper
competition.
🥇 I led Shellphish to qualify for the DARPA Cyber Grand Challenge (and win a $750,000
prize). 7 teams qualified out of more than 100 entrants.
🥇 Before passing on the mantle, I led Shellphish through a number of CTF victories and
other finalist finishes in many competitions around the world, over the course of most of a
decade.
github.com/ As one of the leaders of the Order of the Overflow, I organize the DEF CON CTF,
o-o-overflow the "world championship" of cybersecurity competitions. The challenges and
infrastructure we open source end up here.
github.com/ With the rest of my hacking team, Shellphish, I released various tools and
shellphish educational materials relating to security. For example, how2heap, a set of
heap exploitation tutorials, is one of our popular projects.
github.com/ My hacking team, Shellphish, open-sourced our CRS, the Mechanical Phish,
mechaphish which won third place at the DARPA Cyber Grand Challenge.
openglad.org I co-led the effort to port and improve a game called Gladiator for modern
platforms under the name Openglad. This has involved releases on every
major OS and Android.
github.com/ I enjoy solving problems in original ways. When I solve an interesting problem
zardus or just create something nice, I open source it. There's a fair bit of useful
security software here: preeny, ctf-tools, memcurses, idalink, kuboid, and
others.
Invited Talks and Presentations
Panelist. Quo vadis Cyber Security? Are we really building defense systems, or are we all just into
attacks for fun and profit?. NSF SaTC PI Meeting 2022.
Keynote. How Cyber Reasoning Systems Stub Their Toes. EUROSEC 2022.
Invited Talk. pwn.college: The Cybersecurity Dojo for Binary Analysis. CODE BLUE 2020.
Panelist. Talent Cultivation, the post-pandemic talent cultivation challenges and opportunity.
HITCON 2020.
Invited Talk. Theory to Practice: Applying Academic Program Analysis Advances in the Real
World. Disclosure 2020.
Keynote. Wax on, wax off: educating the next generation of hackers! HITCON 2019.
Keynote. The Dangers of the Subconscious Mind (of Cyber Reasoning Systems). Artificial
Intelligence and Cybersecurity Workshop 2019.
Invited Talk. Master and Automation in Cybersecurity. Tsinghua Inforsec Workshop 2019.
Invited Seminar. How to Train Your Dragon: The Quest Toward Master and Automation in
Cybersecurity. Rensselaer Polytechnic Institute 2019.
Invited Talk. The Rise, Tribulations, and Promises of the HaCRS. NSA Research 2018.
Distinguished Seminar. The Long Road to Cyber Autonomy. CMU Cylab 2018.
Keynote. All our Powers Combined: Connecting Academics, Engineers, and Hackers. HITCON
2017.
Keynote. Reaching for Cyber Autonomy - From the Cradle to the Server Room. Samsung Security
Forum 2017.
Panelist. Panel on Shifting the Balance in the Attack-Defend Cycle. HotSoS 2017.
Invited Talk. Through the Cyber Grand Challenge and Beyond. DHS/SRI Infosec Technology
Transition Council Meeting 2016.
Invited Seminar. From the Lab to the Cyber Grand Challenge. ASU Center for Cybersecurity and
Digital Forensics Seminar Series 2016.
Invited Talk. Towards the DARPA Cyber Grand Challenge: A Dozen Years of Shellphish. SECCON
2015.
Invited Talk. A Dozen Years of Shellphish - From Defcon to the DARPA Cyber Grand Challenge.
HITCON CMT 2015.
Invited Talk. Angry Hacking - The Next Generation of Binary Analysis. DEFCON 2015.
Invited Talk. Dark Side of the ELF - Leveraging Dynamic Loading to pwn noobs. DEFCON 2015.
Invited Talk. Using Static Binary Analysis to Find Vulnerabilities and Backdoors in Firmware.
Blackhat 2015.
Tool Presentation. CTF Tools - Taking the Headache out of Security Tool Installation. Blackhat
Arsenal 2015.
Tool Presentation. Preeny - LD_PRELOAD for Security Analysis. Blackhat Arsenal 2015.
Service
Completed Mentorship
Teaching
Endeavors
◌ I am a leader of the Order of the Overflow, the organizers of the DEF CON CTF, the world
championship of cybersecurity competitions, from 2018 through 2021.
◌ I was the captain for Shellphish's participation in the DARPA Cyber Grand Challenge. We
finished in 3rd place, of 7 finalists (out of over 100 teams). We were the top-placing
"unfunded" team, the top-placing academic team, and the only team to open-source our
Cyber Reasoning System.
◌ I have competed on the UCSB Security Lab team (team Shellphish) at the DEFCON CTF
from 2009 through 2017, leading it from 2011 through 2017. In 2015, our team ranked 4th
worldwide.
◌ I have been a leading or core member of the organization team behind the 2011 through
2016 UCSB iCTF Computer Security competitions.
◌ I organized and taught at the UCSB Hacking Club meetings from 2011 to 2017.
◌ I danced Ballroom Dance competitively through college, and continue to dance West
Coast Swing.
◌ I hold a black belt in Taekwondo from two studios.